CVE-2026-75842: ArcadeDB Path Traversal Vulnerability

CVE-2026-75842 Overview

CVE-2026-75842 is an arbitrary file read vulnerability affecting ArcadeDB versions before 26.8.1. The flaw resides in the OpenCypher LOAD CSV FROM clause, which accepts the file:// protocol without adequate path restrictions. Authenticated users with read query privileges can craft OpenCypher queries that read arbitrary files from the local filesystem using the ArcadeDB server process privileges. Query responses return the file contents directly to the attacker, enabling exfiltration of configuration files, credentials, and other sensitive data. The issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated attackers with minimal query privileges can exfiltrate arbitrary local files, including database credentials, system configuration, and private keys accessible to the ArcadeDB service account.

Affected Products

ArcadeDB versions prior to 26.8.1
Deployments exposing OpenCypher query interfaces to authenticated users
Instances with default read query privileges granted to non-administrative accounts

Discovery Timeline

2026-08-18 - CVE-2026-75842 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75842

Vulnerability Analysis

ArcadeDB implements the OpenCypher query language, which includes the LOAD CSV FROM clause for ingesting data from external sources. The clause resolves URI schemes to locate the CSV source. In vulnerable versions, the parser accepts the file:// scheme without sandboxing the target path against a configured data directory. Any authenticated user holding read query privileges can point LOAD CSV FROM at an arbitrary local path.

The server reads the referenced file using its own process credentials. It then streams the parsed rows back through the standard query response. This produces a reliable read primitive over the network without requiring shell access or higher database roles.

Root Cause

The root cause is missing path validation on the URI supplied to LOAD CSV FROM. The implementation trusts the scheme and path without enforcing an allowlist of directories or protocols. It does not restrict resolution to the ArcadeDB data root, and it does not require an administrative role for local filesystem access.

Attack Vector

An attacker authenticates against ArcadeDB with any account that can execute read queries. The attacker submits an OpenCypher query that uses LOAD CSV FROM 'file:///path/to/target' and returns the parsed rows. Sensitive files such as /etc/passwd, configuration files under the ArcadeDB installation directory, or credential material owned by the service account are returned directly in the query result. Network reachability to the ArcadeDB query endpoint is the only prerequisite beyond low-privilege authentication.

See the GitHub Security Advisory GHSA-hfp5-6gcp-8c75 and the VulnCheck Advisory for ArcadeDB for additional technical detail.

Detection Methods for CVE-2026-75842

Indicators of Compromise

OpenCypher queries in ArcadeDB logs containing LOAD CSV FROM with a file:// URI scheme.
Query responses returning content patterns consistent with system files, such as /etc/passwd entries or private key headers.
Read queries from low-privilege service accounts referencing filesystem paths outside the configured ArcadeDB data directory.

Detection Strategies

Enable ArcadeDB query auditing and alert on any query text containing the substring LOAD CSV FROM 'file: or LOAD CSV FROM "file:.
Correlate authentication events with query logs to identify low-privilege accounts issuing filesystem-oriented queries.
Baseline normal LOAD CSV usage per account and flag deviations that reference absolute filesystem paths.

Monitoring Recommendations

Forward ArcadeDB query and access logs to a centralized analytics platform for retention and correlation.
Monitor outbound response sizes from the ArcadeDB query endpoint for anomalous transfer volumes tied to LOAD CSV operations.
Track process-level file access on the ArcadeDB host and alert when the service reads files outside its data directory.

How to Mitigate CVE-2026-75842

Immediate Actions Required

Upgrade ArcadeDB to version 26.8.1 or later on all instances.
Audit existing user accounts and revoke read query privileges from any principal that does not require them.
Review query logs since the initial deployment for prior LOAD CSV FROM 'file://' invocations and treat matching accounts as potentially compromised.

Patch Information

ArcadeDB 26.8.1 addresses the vulnerability by restricting the URI schemes and paths accepted by LOAD CSV FROM. Refer to the GitHub Security Advisory GHSA-hfp5-6gcp-8c75 for the fixed release and upgrade instructions.

Workarounds

Restrict network access to the ArcadeDB query endpoint so it is reachable only from trusted application servers.
Run the ArcadeDB service under a dedicated low-privilege account that has no read access to sensitive files outside its data directory.
Remove read query permissions from shared or application accounts until the upgrade to 26.8.1 is complete.

bash

# Verify the running ArcadeDB version and confirm the upgrade
./bin/server.sh -version

# Enforce least privilege on the ArcadeDB service account (Linux example)
chown -R arcadedb:arcadedb /opt/arcadedb
chmod -R o-rwx /opt/arcadedb