Dashboard / CVE-2025-71394

CVE-2025-71394

LOW
INFO Priority: 0.01 BB Relevance: 55/100
Published: 2026-07-18 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: Present
VC: Low
VI: None
VA: None

Description

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

Weakness Classification (1)

Affected Software (5)

VendorProductVersion
surrealdb surrealdb 2.2.0 < 2.2.2
surrealdb surrealdb 0 < 2.1.5
surrealdb surrealdb < 2.1.5
surrealdb surrealdb 2.2.0 < 2.2.2
surrealdb surrealdb 0 < 2.1.5

References & Advisories (2)

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

2.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.37%
Raw Score 0.003670
Percentile 30.5%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links