CVE-2026-75842: ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-10-22
Weakness: CWE-22

Description

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server process privileges, exfiltrating sensitive data directly in query responses.

Affected products

ArcadeData arcadedb: before 26.8.1 — fixed in 26.8.1

How to fix

Upgrade to a fixed version: ArcadeData arcadedb 26.8.1. Check the vendor advisory for mitigations.

References

https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75
https://www.vulncheck.com/advisories/arcadedb-before-arbitrary-file-read-via-load-csv
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75

Get alerted when CVE-2026-75842 or the next vulnerability affects your stack