ArcadeDB (com.arcadedb:arcadedb-engine) versions prior to 26.9.1 contain an incomplete deny-list in the polyglot script sandbox. The deny-list blocks java.util.ResourceBundle by exact class name but does not block its subclasses like java.util.PropertyResourceBundle or java.util.ListResourceBundle. Since ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*, a user with UPDATE_SCHEMA privilege can create or alter JavaScript triggers to invoke ResourceBundle.getBundle(String) on these subclasses. This allows reading .properties resource files from the application classpath, disclosing sensitive configuration data such as database credentials and API keys. The sandbox restricts IO access (denying java.io.*, java.nio.*, and java.net.*), so arbitrary host filesystem reads or remote code execution are not possible. The issue is fixed in ArcadeDB 26.9.1.

An attacker with UPDATE_SCHEMA privileges can read packaged application configuration files containing sensitive information like database credentials and API keys. This disclosure could lead to further compromise of the application environment. However, the vulnerability does not allow arbitrary filesystem access or remote code execution, limiting the scope of impact.

Upgrade ArcadeDB to version 26.9.1 or later, where this vulnerability is fixed. Users should apply this official fix to prevent unauthorized disclosure of application configuration data. No other mitigations are indicated by the vendor advisory.