7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54077

CVE-2026-54077: ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54077

CVE-2026-54077:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.arcadedb:arcadedb-engine	maven	< 26.6.1	26.6.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the IMPORT DATABASE SQL statement functionality of ArcadeDB. The root cause is a combination of insufficient access control and a lack of input validation. Specifically, the ImportDatabaseStatement.executeSimple method did not require administrative privileges, allowing any authenticated user to execute it. The SourceDiscovery.getSource method, which is called by executeSimple, did not validate the provided URL, making it vulnerable to Server-Side Request Forgery (SSRF) and arbitrary file reads. An attacker could exploit this by providing a specially crafted URL pointing to an internal service or a local file path. Additionally, the XML importer used by this feature was vulnerable to XML External Entity (XXE) attacks because it did not disable DTD processing, as seen in the XMLImporterFormat.load and XMLImporterFormat.analyze methods. The patch addresses these issues by adding a permission check to ImportDatabaseStatement.executeSimple, implementing URL validation in SourceDiscovery.getSource via the new ImportSecurityValidator class, and disabling DTD processing in XMLImporterFormat.

Vulnerable functions

com.arcadedb.query.sql.parser.ImportDatabaseStatement.executeSimple

engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java

This function was vulnerable because it did not perform a permission check before executing the `IMPORT DATABASE` statement. This allowed any authenticated user to trigger the import, leading to SSRF or arbitrary file reads. The patch adds a permission check to ensure only administrative users can execute this statement.

com.arcadedb.integration.importer.SourceDiscovery.getSource

integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java

This function was vulnerable because it did not validate the source URL before processing it. This allowed an attacker to provide a malicious URL to trigger an SSRF attack or a path to a local file to read its contents. The patch adds calls to `ImportSecurityValidator.validateRemoteURL` and `ImportSecurityValidator.validateLocalURL` to validate the URL before use.

com.arcadedb.integration.importer.format.XMLImporterFormat.load

integration/src/main/java/com/arcadedb/integration/importer/format/XMLImporterFormat.java

This function was vulnerable to XML External Entity (XXE) injection and entity expansion attacks because it did not disable DTD processing in the XML parser. An attacker could craft a malicious XML file with external entities to read local files or cause a denial of service. The patch disables DTD processing and external entities to mitigate this.

com.arcadedb.integration.importer.format.XMLImporterFormat.analyze

integration/src/main/java/com/arcadedb/integration/importer/format/XMLImporterFormat.java

Similar to the `load` function, this function was also vulnerable to XXE and entity expansion attacks because it did not disable DTD processing in the XML parser. The patch disables DTD processing and external entities to mitigate this vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.