CVE-2026-54077 is a path traversal vulnerability (CWE-22) in ArcadeDB prior to version 26.6.1. The IMPORT DATABASE statement did not require administrative privileges and passed unvalidated source paths to the importer, allowing authenticated users with SQL command access via /api/v1/command or /api/v1/query to specify HTTP, HTTPS, or file:// destinations. This enables server-side requests to internal services or reading of local files accessible to the server process, with results ingested as queryable records. Additionally, the XML importer permitted DTD processing and external entities, facilitating entity expansion attacks (CWE-776, CWE-918). The root-only /api/v1/server endpoint is unaffected. The fix in 26.6.1 enforces updateSecurity permission, blocks local-network imports by default, supports an allow-list for local paths, and disables XML DTD and external entity processing.

An authenticated user with SQL command access can exploit this vulnerability to perform server-side request forgery (SSRF) to internal services or read arbitrary files accessible to the ArcadeDB server process. This can lead to unauthorized disclosure of sensitive information (confidentiality impact rated high) and limited denial of service (availability impact rated low). Integrity impact is not indicated. The vulnerability does not require administrative privileges but does require authenticated SQL command access.

Upgrade to ArcadeDB version 26.6.1 or later, which fixes this vulnerability by requiring updateSecurity permission for imports, blocking local-network import destinations by default, supporting an allow-list for local file paths, and disabling XML DTD processing and external entities. If upgrading is not immediately possible, restrict SQL command access to trusted users only and disable or restrict the IMPORT DATABASE functionality. Review and configure arcadedb.server.security.importBlockLocalNetworks and arcadedb.server.security.importAllowedLocalPaths settings as per security policy.