PT-2026-42677 · Nocodb · Nocodb

Published 2026-05-21 · Updated 2026-05-21 · CVE-2026-46551

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NocoDB (affected versions not specified)

Description The uploadViaURL path in the v1/v2 attachment API fails to enforce the NC ATTACHMENT FIELD SIZE limit against the remote content-length or the response stream. An authenticated user with Editor or higher privileges can direct the server to download arbitrarily large files via the endpoints 'POST /api/v1/db/storage/upload-by-url' and 'POST /api/v2/storage/upload-by-url'. This can lead to disk space exhaustion, resulting in a denial of service that may block database writes, prevent log rotation, and cause application crashes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-46551

GHSA-99VC-2JX2-688P

Affected Products

Nocodb

References · 4

• https://osv.dev/vulnerability/GHSA-99vc-2jx2-688p · Vendor Advisory
• https://github.com/nocodb/nocodb/security/advisories/GHSA-99vc-2jx2-688p · Note
• https://github.com/nocodb/nocodb · Note
• https://twitter.com/dailycve/status/2057605545809322088 · Twitter Post