What’s Vulnerable › Vulnerabilities

CVE-2025-71394: SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-18 · updated 2026-10-29
• Weakness: CWE-22

Description

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

Affected products

• surrealdb: before 2.1.5; from 2.2.0 before 2.2.2 — fixed in 2.1.5, 2.2.2
• surrealdb: from 2.2.0 before 2.2.2 — fixed in 2.2.2

How to fix

Upgrade to a fixed version: surrealdb 2.1.5, 2.2.2; surrealdb 2.2.2. Check the vendor advisory for mitigations.

References

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2cvj-g5r5-jrrg
• https://www.vulncheck.com/advisories/surrealdb-before-local-file-read-via-define-analyzer

Get alerted when CVE-2025-71394 or the next vulnerability affects your stack