VulnerabilityAnalyzed

CVE-2025-71394

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system.

LOW 2.3EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

CVSS 4.0: 2.3 LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.25% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: surrealdb/surrealdb
Source: disclosure@vulncheck.com

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2cvj-g5r5-jrrgVendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-local-file-read-via-define-analyzerThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.