CVE-2025-71394Disclosure(surrealdb / surrealdb)

LOWCVSS 4.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

surrealdb CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

surrealdb

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

surrealdb

Products

surrealdb

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Vulmon Vulnerability Feed@VulmonFeeds92d
Disclosure
CVE-2025-71394 Local File Read Vulnerability in SurrealDB Before 2.2.2 D... https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-71394 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
A brief announcement of CVE‑2025‑71394, a local file read weakness in SurrealDB versions before 2.2.2, accompanied by a link to a vulnerability summary but lacking details on PoC, exploitation, or remediation.
0000095
4.1K followersView on X
CVE@CVEnew92d
Disclosure
CVE-2025-71394 SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on th… https://www.cve.org/CVERecord?id=CVE-2025-71394
Post summary
The CVE details a local file read flaw in SurrealDB's DEFINE ANALYZER, impacting versions before 2.2.2 and allowing authenticated users to read arbitrary files; no exploitation or mitigation information is supplied.
00000608
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	surrealdb	surrealdb	-	-	-

Explore more

Back to dashboard surrealdb CVEs surrealdb vulnerabilities