Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the upload-by-URL path did not enforce NC_ATTACHMENT_FIELD_SIZE against either the remote file's advertised Content-Length or the decoded length of a data: URI, allowing an authenticated user to bypass the configured per-file size limit. This vulnerability is fixed in 2026.04.1.
Published: 2026-06-23
Score: 2.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Prior to 2026.04.1, NocoDB’s upload‑by‑URL feature ignored the configured NC_ATTACHMENT_FIELD_SIZE limit when evaluating the remote file’s Content‑Length header or the decoded size of a data URI, allowing an authenticated user to upload a file larger than the allowed size. This privileged bypass enables storage of arbitrarily large files, potentially exhausting disk space or triggering resource‑based denial‑of‑service conditions. The flaw is categorized as CWE‑770, indicating a limitation on available resources.

Affected Systems

The affected product is NocoDB (vendor nocodb) running any release before 2026.04.1. Any user who relies on the upload‑by‑URL functionality and has authentication privileges is at risk.

Risk and Exploitability

The CVSS score of 2.1 reflects a low impact on confidentiality, integrity, and availability. There is no EPSS score available and the issue is not listed in the CISA KEV catalog. Exploitation requires valid authentication and use of the upload‑by‑URL path; it does not permit unauthenticated users to acquire or deliver large files.

Generated by OpenCVE AI on June 24, 2026 at 09:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade NocoDB to version 2026.04.1 or later, which enforces the attachment size limit on upload‑by‑URL.
  • If an upgrade is not immediately possible, disable the upload‑by‑URL feature or remove it from authenticated routes to prevent use of the bypass.
  • Configure the NC_ATTACHMENT_FIELD_SIZE parameter to enforce a stricter size limit or set custom limits on the server side to reduce the risk of resource exhaustion.

Generated by OpenCVE AI on June 24, 2026 at 09:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-8rwr-f68v-cvw6 NocoDB: Attachment Size Limit Bypass via Upload-by-URL
History

Thu, 25 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 24 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Nocodb
Nocodb nocodb
Vendors & Products Nocodb
Nocodb nocodb

Tue, 23 Jun 2026 21:15:00 +0000

Type Values Removed Values Added
Description NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the upload-by-URL path did not enforce NC_ATTACHMENT_FIELD_SIZE against either the remote file's advertised Content-Length or the decoded length of a data: URI, allowing an authenticated user to bypass the configured per-file size limit. This vulnerability is fixed in 2026.04.1.
Title NocoDB: Attachment Size Limit Bypass via Upload-by-URL
Weaknesses CWE-770
References
Metrics cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Nocodb Nocodb
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-06-25T12:48:27.742Z

Reserved: 2026-05-14T20:42:31.369Z

Link: CVE-2026-46553

cve-icon Vulnrichment

Updated: 2026-06-25T12:48:23.525Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-24T10:00:05Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling