Path Traversal in Nocodb

CVE-2026-47385

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB's own internal d…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.003 (24.8th percentile) — read the EPSS interpretation.