CVE-2026-47385

The record

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB's own internal databases. The SQLite client and the base/integration create services accepted a caller-supplied filename and passed it to fs.exists and fs.open('w') without restricting the location. A user could point a source at noco.db, at a tenant database under nc_minimal_dbs/, or at any writable path the NocoDB process can reach, and then read or overwrite its contents through the regular table APIs.This vulnerability is fixed in 2026.05.1.

Affected packages

Related vulnerabilities

• GHSA-wvqj-9wv4-7ff5 NocoDB: Path Traversal via SQLite Source Filename Same vulnerability
• CVE-2026-53928 NocoDB is software for building databases as spreadsheets. Also affects nocodb
• CVE-2026-53929 NocoDB is software for building databases as spreadsheets. Also affects nocodb
• CVE-2026-53927 NocoDB is software for building databases as spreadsheets. Also affects nocodb
• CVE-2026-53930 NocoDB is software for building databases as spreadsheets. Also affects nocodb
• CVE-2026-53931 NocoDB is software for building databases as spreadsheets. Also affects nocodb
• CVE-2026-53926 NocoDB is software for building databases as spreadsheets. Also affects nocodb
• CVE-2026-47386 NocoDB is software for building databases as spreadsheets. Also affects nocodb