PT-2026-47083 · Git+2 · Nocodb
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
NocoDB versions prior to 2026.05.1
Description
An authenticated user with base-create permission can attach a SQLite source pointing to an arbitrary file on the host, including internal databases. The SQLite client and the base/integration create services accept a caller-supplied filename and pass it to the
fs.exists and fs.open('w') functions without restricting the location. This allows a user to point a source at noco.db, a tenant database under nc minimal dbs/, or any writable path accessible to the NocoDB process, enabling the reading or overwriting of contents through regular table APIs. This can lead to the disclosure and modification of internal state, other tenants' databases, and any file the process can access.Recommendations
Update to version 2026.05.1.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nocodb