CVE-2026-54077

ArcadeDB versions prior to 26.6.1 allow an authenticated user with SQL command access via /api/v1/command or /api/v1/query to execute the IMPORT DATABASE statement without administrative privileges, and the source parameter is passed to SourceDiscovery without validation. By supplying HTTP or HTTPS destinations, the attacker triggers server-side requests to internal services (SSRF); by supplying file:// paths, the attacker reads files accessible to the server process and ingests them as queryable records. The XML importer additionally permits DTD processing and external entities, enabling entity expansion attacks. The fix in version 26.6.1 requires the updateSecurity permission, blocks local-network import destinations by default via arcadedb.server.security.importBlockLocalNetworks, adds a file allow-list (arcadedb.server.security.importAllowedLocalPaths), and disables XML DTD processing. No public proof of concept is known and the issue is not listed in CISA's KEV.

What to do: Upgrade to ArcadeDB 26.6.1 or later, which enforces the updateSecurity permission for IMPORT DATABASE, blocks local-network destinations by default, supports an allowed-paths file allow-list, and disables XML DTD/external-entity processing. If immediate upgrade is not possible, restrict access to /api/v1/command and /api/v1/query to trusted, minimally privileged accounts and review server logs for IMPORT DATABASE statements using http(s):// or file:// sources, which may indicate probing for internal services or local file ingestion.