The flaw allows an authenticated user who possesses base‑create permission to attach a SQLite source that points to any file writable by the NocoDB process. By supplying an arbitrary file name, the system subsequently uses that name in filesystem checks and writes, enabling the attacker to read from or overwrite the target file through the normal table APIs. This constitutes a path traversal vulnerability, CWE‑22, that manifests as local file read/write capabilities.

The vulnerability affects NocoDB installations running any version older than 2026.05.1. All users who can create bases or integrations in such installations are potentially impacted; the flaw is only exploitable if the user has the base‑create permission. The issue is specific to the NocoDB product and is not present in later releases.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, meaning no known widespread exploitation has been reported. Exploitation requires only legitimate authentication and the base‑create permission, which may be widely granted in deployments. No further security consequences are described beyond the ability to read or alter files that the NocoDB process can reach.