PT-2026-60955 · Surrealdb · Surrealdb

Cure53 · CVE-2025-71394 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.2.2

Description Authenticated users with root, namespace, or database level privileges can read arbitrary files on the file system. This occurs through the DEFINE ANALYZER statement, where attackers can point analyzers to arbitrary file paths to exfiltrate content from two-column tab-separated files.

Recommendations Update SurrealDB to version 2.2.2 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-71394

Affected Products

Surrealdb

References · 4

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2cvj-g5r5-jrrg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71394 · Security Note
• https://vulncheck.com/advisories/surrealdb-before-local-file-read-via-define-analyzer · Note
• https://twitter.com/VulmonFeeds/status/2078523033619181905 · Twitter Post