Path Traversal in Surrealdb
CVE-2025-71394
SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileg…
Vulnerability class: Path Traversal (Directory Traversal)
Affected products
- Surrealdb — versions 0, 2.2.2, 2.1.5
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)