CVE-2026-75840 affects ArcadeDB before version 26.8.1. The vulnerability arises from the use of unescaped regular expressions in the GraalVM JavaScript sandbox allowlist enforcement, which is intended to validate package names. Attackers who have the ability to create triggers can exploit this by invoking Java.type() to load java.util.zip.ZipFile or java.util.jar.JarFile classes, enabling them to read arbitrary files on the server hosting ArcadeDB. This constitutes an arbitrary file read vulnerability.

Successful exploitation allows an attacker with trigger creation privileges to read arbitrary files on the host system where ArcadeDB is running. This can lead to unauthorized disclosure of sensitive information stored on the server. The vulnerability does not require user interaction, privileges beyond trigger creation, or network complexity, making it a high-severity risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict trigger creation privileges to trusted users only to mitigate exploitation risk.