Impact The SQL IMPORT DATABASE statement did not require administrative privileges and passed its source URL to the importer without validation. Any authenticated user with SQL command access (not only root/administrato…
| CVE ID | CVE-2026-54077 |
| Vendor | maven |
| Affected Product | com.arcadedb:arcadedb-engine |
| Vulnerability Type | Vulnerability |
| CVSS Score | 7.1 (HIGH) |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
#
IMPORT DATABASE statement did not require administrative privileges and passed its source URL to the importer without validation. Any authenticated user with SQL command access (not only root/administrators) could therefore: - Server-Side Request Forgery (CWE-918): cause the server to issue HTTP(S) requests to arbitrary destinations, including cloud metadata endpoints (e.g. 169.254.169.254) and internal-only services, and ingest the responses as queryable records./etc/passwd, credential files) by importing file:// paths, exposing their contents as records. The server administration endpoint (/api/v1/server) was already restricted to the root user and was **Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.