CVE-2026-126293

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.06.2

Description An attachment size limit bypass exists that allows authenticated Editor users to store oversized files. This occurs because the data-attachment-v3.service.ts file trusts the content length advertised by the remote server. An attacker can target the v3 upload-by-URL endpoint by pointing it to a server that understates or omits the length, potentially leading to the exhaustion of disk space or storage quota.

Recommendations Update NocoDB to version 2026.06.2 or later.