CVE-2026-47385— NocoDB: Path Traversal via SQLite Source Filename
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47385
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NocoDB: Path Traversal via SQLite Source Filename
Source: NVD (National Vulnerability Database)
Vulnerability Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB's own internal databases. The SQLite client and the base/integration create services accepted a caller-supplied filename and passed it to fs.exists and fs.open('w') without restricting the location. A user could point a source at noco.db, at a tenant database under nc_minimal_dbs/, or at any writable path the NocoDB process can reach, and then read or overwrite its contents through the regular table APIs.This vulnerability is fixed in 2026.05.1.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-47385
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47385
请登录查看更多情报信息。
Other References for CVE-2026-47385 (1)
Same Patch Batch · nocodb · 2026-06-23 · 29 CVEs total
| CVE-2026-46551 | 6.5 MEDIUM | NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk E |
| CVE-2026-46547 | 6.1 MEDIUM | NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL |
| CVE-2026-47375 | 6.0 MEDIUM | NocoDB: Postgres SQL Injection in Formula `ARRAYSORT` |
| CVE-2026-46552 | 5.8 MEDIUM | NocoDB: Shared-base link access can invite arbitrary users as persistent base members |
| CVE-2026-46550 | 5.4 MEDIUM | NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags |
| CVE-2026-46548 | 4.3 MEDIUM | NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost |
| CVE-2026-46549 | 2.0 LOW | NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation |
| CVE-2026-47377 | NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin | |
| CVE-2026-46553 | NocoDB: Attachment Size Limit Bypass via Upload-by-URL | |
| CVE-2026-46554 | NocoDB: Stale Auth Cache After API Token Deletion | |
| CVE-2026-47382 | NocoDB: Server-Side Request Forgery via Database Connection Host | |
| CVE-2026-47376 | NocoDB: Reflected Cross-Site Scripting via Password Reset Token | |
| CVE-2026-47384 | NocoDB: SQL Injection via Column Title in Bulk GroupBy | |
| CVE-2026-47386 | NocoDB: OAuth Authorization Code Race Condition | |
| CVE-2026-53929 | NocoDB: Stored Cross-Site Scripting via Secure Attachment | |
| CVE-2026-47381 | NocoDB: Cross-Workspace Integration Use in Connection Test | |
| CVE-2026-47378 | NocoDB: Hidden Column Exposure in Public Shared View Endpoints | |
| CVE-2026-47379 | NocoDB: Plaintext Password Comparison in Shared Views | |
| CVE-2026-47388 | NocoDB: Missing Ownership Check in MCP Attachment Read | |
| CVE-2026-47387 | NocoDB: Stored Cross-Site Scripting via Form View Redirect URL |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: nocodb
- CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redi - CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugi - CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows S - CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `Secure` and `SameS - CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users a
Same vendor: nocodb
- CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redi - CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugi - CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows S - CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `Secure` and `SameS - CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users a
Same weakness: CWE-22
- CVE-2026-54557
mise HTTP backend uses raw version path for install symlink - CVE-2026-56876
extract-zip unvalidated symlink path traversal - CVE-2026-55677
Echo: Encoded slash (%2F) bypasses route-level protection an - CVE-2026-57321
WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vul - CVE-2026-56066
WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbi
V. Comments for CVE-2026-47385
No comments yet