جزئیات آسیب‌پذیری
CVE-2026-65831
ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
شرح رسمی (انگلیسی)
ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object through database.getClass().getClassLoader().loadClass to arbitrary host classes. These cooperating defects allow a read-only database user to read arbitrary host files outside the database scope. Process creation is already blocked, so OS command execution is not confirmed. The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. This issue is fixed in version 26.7.1.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.7بالا | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| ArcadeData | arcadedb | < 26.7.1 | CVEProject cvelistV5 (CNA) |
| com.arcadedb | arcadedb-server | < 26.7.1 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۳- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-48qw-824m-86pr x_refsource_CONFIRM
- https://github.com/ArcadeData/arcadedb/commit/8ca396c07e471a0b97fee075eeb956b5e24a23be x_refsource_MISC
- https://github.com/ArcadeData/arcadedb/releases/tag/26.7.1 x_refsource_MISC
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۶/۲۴
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۲۴
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-269Improper Privilege Management
- CWE-863Incorrect Authorization