Path Traversal in Nocodb

CVE-2026-47385

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB's own internal d…

Vulnerability class: Path Traversal (Directory Traversal)

Affected products

  • Nocodb — versions < 2026.05.1

Weakness classification (CWE)

References