CVE-2026-63739

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5

Description An arbitrary file read issue exists in the DEFINE ANALYZER mapper filter. Database users with EDITOR or OWNER roles can read files accessible to the SurrealDB process by specifying arbitrary file paths in the mapper filter. The file contents are then retrieved through query error messages, provided that the SURREAL FILE ALLOWLIST variable is empty or not configured.

Recommendations Update SurrealDB to version 3.1.5 or later. Configure the SURREAL FILE ALLOWLIST variable to restrict file access.