arcadedb-engine vulnerabilities

2 known vulnerabilities in arcadedb-engine from Com.arcadedb. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  arcadedb: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-54077Sep 15, 2026ArcadeData

  ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/a

• 8.1 High severity

  arcadedb: Missing Authorization

  CVE-2026-54076Sep 15, 2026ArcadeData

  ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumen