CVE-2025-71394 — SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER
SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file syst…
Published: 2026-07-18 · CVSS: 2.3 · CVSS 4.0
SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7