Unrated severityNVD Advisory· Published Jul 18, 2026· Updated Jul 28, 2026
SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER
CVE-2025-71394
Description
SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/surrealdb/surrealdb/security/advisories/GHSA-2cvj-g5r5-jrrgmitrevendor-advisory
- www.vulncheck.com/advisories/surrealdb-before-local-file-read-via-define-analyzermitrethird-party-advisory
News mentions
0No linked articles in our index yet.