Server-side Request Forgery (SSRF) Affecting com.arcadedb:arcadedb-server package, versions [,26.6.1)

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through IMPORT DATABASE in ImportDatabaseStatement, SourceDiscovery, and the import source handlers. An authenticated SQL user can trigger the flaw by supplying an IMPORT DATABASE URL or path that points to a remote internal address or a local file, causing the server to fetch attacker-chosen content and import it as records. This lets the attacker reach internal services such as cloud metadata endpoints or read files like /etc/passwd from the server process. The result is exposure of internal network responses and local file contents to the user through the database import output.

Notes

• IMPORT DATABASE is exposed over the SQL command/query endpoints, not the server administration API; the maintainer advisory says /api/v1/server was already root-only and unaffected.
• Local-file imports are gated by the optional arcadedb.server.security.importAllowedLocalPaths allow-list; when it is set, file:// and plain-path sources are restricted to the configured directories, while classpath:// resources remain permitted.

Workarounds

• Restrict SQL command/query access to trusted administrative users; do not grant IMPORT DATABASE capability to untrusted accounts, which prevents authenticated non-admin users from triggering SSRF to internal endpoints or reading local files through the import path.

• GitHub Commit 26.6.1
• Maintainer's Advisory