ArcadeDB versions before 26.8.1 allow attackers with trigger creation privileges to read arbitrary files on the host system. The vulnerability arises from unescaped regular expressions used by the GraalVM JavaScript sandbox allowlist when validating package names. By exploiting the sandbox, an attacker can invoke Java.type() to load java.util.zip.ZipFile or java.util.jar.JarFile classes and read any file accessible to the ArcadeDB server process, violating confidentiality.

Affected systems are installations of ArcadeData's ArcadeDB database service running any version prior to 26.8.1. The issue is specific to the GraalVM sandbox configuration embedded in these releases.

The CVSS score of 8.7 classifies the issue as high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited known exploitation but potential risk if the environment is exposed. The attack is limited to users who can create triggers, so internal privileged users or those who can authenticate to the database could use it. Once the attacker has trigger creation rights, the Java.type() call can be used to read any file the server process can access, making it a serious confidentiality breach.