Skip to content
Heist/ feed
Back to feed
Medium

NocoDB: Path Traversal via SQLite Source Filename

Type: advisorySources: OSV

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB's own internal databases. The SQLite client and the base/integration create services accepted a caller-supplied filename and passed it to fs.exists and fs.open('w') without restricting the location. A user could point a source at noco.db, at a tenant database under nc_minimal_dbs/, or at any writable path the NocoDB process can reach, and then read or overwrite its contents through the regular table APIs.This vulnerability is fixed in 2026.05.1.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-47385
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 16:38 UTC · Revision 1

Source evidence

NocoDB: Path Traversal via SQLite Source Filename

core-osv · Original source

Published 23 Jun 2026, 20:13 UTC

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB's own internal databases. The SQLite client and the base/integration create services accepted a caller-supplied filename and passed it to fs.exists and fs.open('w') without restricting the location. A user could point a source at noco.db, at a tenant database under nc_minimal_dbs/, or at any writable path the NocoDB process can reach, and then read or overwrite its contents through the regular table APIs.This vulnerability is fixed in 2026.05.1.

osv:CVE-2026-47385
Complete source record
{
  "id": "204ff9025b025e27c659d3bc60dce7d7b0a6b995fd890fa1dee94e93fa0c7185",
  "url": "https://osv.dev/vulnerability/CVE-2026-47385",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "NocoDB: Path Traversal via SQLite Source Filename",
    "summary": "NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB's own internal databases. The SQLite client and the base/integration create services accepted a caller-supplied filename and passed it to fs.exists and fs.open('w') without restricting the location. A user could point a source at noco.db, at a tenant database under nc_minimal_dbs/, or at any writable path the NocoDB process can reach, and then read or overwrite its contents through the regular table APIs.This vulnerability is fixed in 2026.05.1.",
    "evidence": "osv:CVE-2026-47385",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-47385",
      "aliases": [
        "CVE-2026-47385",
        "GHSA-wvqj-9wv4-7ff5"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nocodb/nocodb",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "93adcf0cdc77cd4fc8e1c6aa8a6c8b8b2226e74e"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2026.05.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2026.05.1"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "2026.05.1-pre.1",
            "2026.05.0",
            "2026.04.5-test-build.01",
            "2026.04.5",
            "2026.04.4",
            "2026.04.3",
            "2026.04.2",
            "2026.04.1",
            "2026.04.0",
            "0.301.5-test.1",
            "0.301.5",
            "0.301.4",
            "0.301.3-test-build-7",
            "0.301.3-test-build-6",
            "0.301.3-test-build-5",
            "0.301.3-test-build-4",
            "0.301.3-test-build-3",
            "0.203.2",
            "0.203.1",
            "0.203.0",
            "0.202.10",
            "0.202.9",
            "0.202.8",
            "0.202.7",
            "0.202.6",
            "0.202.5",
            "0.202.0",
            "0.200.0",
            "0.111.4",
            "0.111.3",
            "0.111.2",
            "0.111.1",
            "0.111.0",
            "0.109.7",
            "0.109.6",
            "0.109.5",
            "0.109.4",
            "0.109.3",
            "0.109.2",
            "0.109.1",
            "0.109.0",
            "0.108.1",
            "0.108.0",
            "0.108.0-beta.0",
            "0.107.5",
            "0.107.4",
            "0.107.3",
            "0.107.2",
            "0.107.1",
            "0.107.0",
            "0.107.0-beta.1",
            "0.107.0-beta.0",
            "0.106.1",
            "0.106.0",
            "0.106.0-beta.1",
            "0.106.0-beta.0",
            "0.105.3",
            "0.105.2",
            "0.105.1",
            "0.105.0",
            "0.104.3",
            "0.104.2",
            "0.104.1",
            "0.101.2",
            "0.101.0",
            "0.101.0-beta.0",
            "0.100.2",
            "0.100.1",
            "0.100.0",
            "0.99.2",
            "0.99.1",
            "0.99.0",
            "0.98.4",
            "0.98.3",
            "0.98.2",
            "0.98.1",
            "0.97.0",
            "0.96.4",
            "0.96.0",
            "0.92.4",
            "0.92.3",
            "0.92.2",
            "0.92.0",
            "0.92.1",
            "0.91.10",
            "0.91.9",
            "0.91.8",
            "0.91.7",
            "0.91.6",
            "0.91.1",
            "0.91.0",
            "0.90.11",
            "0.90.10",
            "0.90.9",
            "0.90.8",
            "0.90.7",
            "0.90.4",
            "0.90.3",
            "0.90.1",
            "0.90.0",
            "0.84.16",
            "0.84.15",
            "0.84.14",
            "0.84.13",
            "0.84.12",
            "0.84.10",
            "0.84.9",
            "0.84.8",
            "0.84.7",
            "0.84.6",
            "0.84.3",
            "0.84.2",
            "0.84.1",
            "0.83.8",
            "0.83.6",
            "0.83.5",
            "0.83.4",
            "0.83.3",
            "0.83.2",
            "0.83.1",
            "0.83.0",
            "0.82.0",
            "0.81.1",
            "0.81.0",
            "0.80.0",
            "0.11.46",
            "0.11.45",
            "0.11.44",
            "0.11.43",
            "0.11.42",
            "0.11.41",
            "0.11.40",
            "0.11.39",
            "0.11.36",
            "0.11.34",
            "0.11.33",
            "0.11.31",
            "0.11.30",
            "0.11.29",
            "0.11.28",
            "0.11.26",
            "0.11.22",
            "0.11.25",
            "0.11.24",
            "0.11.23",
            "0.11.21",
            "0.11.20",
            "0.11.19",
            "0.11.18",
            "0.11.17",
            "0.11.16",
            "0.11.15",
            "0.11.14",
            "0.11.12",
            "0.11.11",
            "0.11.10",
            "0.11.9",
            "0.11.7",
            "0.11.6",
            "0.11.5",
            "0.11.4",
            "0.11.3",
            "0.11.1",
            "0.11.0",
            "0.10.6",
            "0.10.5",
            "0.10.4",
            "0.10.3",
            "0.10.2",
            "0.10.1",
            "v0.10.0",
            "0.10.0",
            "0.9",
            "0.4.9",
            "0.4.8",
            "0.4.5",
            "v0.4.4",
            "v0.4.2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47385.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:37.401190282Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47385.json",
        "https://github.com/nocodb/nocodb/security/advisories/GHSA-wvqj-9wv4-7ff5",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-47385"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47385.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-47385",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 504777,
  "published_at": "2026-06-23T20:13:49.741+00:00"
}