ArcadeDB versions before 26.8.1 contain a flaw in the OpenCypher LOAD CSV FROM clause that permits reading arbitrary local files when the file:// protocol is used. The issue can be leveraged by any authenticated user with read query privileges to exfiltrate data directly in query responses. The vulnerability is classified as a CWE-22 flaw and carries a CVSS score of 8.3, indicating a significant risk of confidentiality compromise.

The affected product is ArcadeData’s ArcadeDB. All releases prior to version 26.8.1 are vulnerable, regardless of other patch levels. Users operating these versions must recognize that the flaw applies to any instance where the database is exposed to authenticated query usage.

The CVSS score of 8.3 reflects moderate to high severity. No EPSS score is available, and the vulnerability is currently not listed in CISA’s KEV catalog, so the current exploitation probability is unknown. Inferred from the description, the attack vector requires an authenticated user with read query privileges; attackers can craft a LOAD CSV statement using the file:// protocol to read owner‑process files and embed the contents in the query output. Once successful, an attacker can access any file readable by the database process, leading to direct data exfiltration.