{"action":"Upgrade com.arcadedb:arcadedb-engine to 26.6.1 or later.","affected":[{"fixed":"26.6.1","introduced":"0"}],"component":"com.arcadedb:arcadedb-engine","cve_ids":["CVE-2026-54077"],"ecosystem":"Maven","epss":0.00447,"exploited":false,"fixed_versions":["26.6.1"],"ghsa_id":"GHSA-8w86-m9h8-hvqg","id":"tcs_01M5N8NJZ8WSM887JRGKANTD5R","modified_at":"2026-07-16T20:26:44.480476Z","published_at":"2026-07-16T20:05:56Z","references":["https://osv.dev/vulnerability/GHSA-8w86-m9h8-hvqg","https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-8w86-m9h8-hvqg","https://github.com/ArcadeData/arcadedb","https://github.com/ArcadeData/arcadedb/releases/tag/26.6.1"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-8w86-m9h8-hvqg","url":"https://osv.dev/vulnerability/GHSA-8w86-m9h8-hvqg"}],"summary":"ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users"}