CVE-2026-47385: NocoDB: Path Traversal via SQLite Source Filename

June 5, 2026 (updated July 20, 2026)

An authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB’s own internal databases.

References

github.com/advisories/GHSA-wvqj-9wv4-7ff5
github.com/nocodb/nocodb/releases/tag/2026.05.1
github.com/nocodb/nocodb/security/advisories/GHSA-wvqj-9wv4-7ff5
nvd.nist.gov/vuln/detail/CVE-2026-47385

Code Behaviors & Features

Detect and mitigate CVE-2026-47385 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →