CVE-2026-47385: NocoDB Path Traversal Vulnerability Allows Unauthorized File Access
Summary
CVE-2026-47385: NocoDB: Path Traversal via SQLite Source Filename. Affects nocodb versions < 2026.05.1. Fixed in 2026.05.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NocoDB is an open-source platform that transforms databases into smart APIs, enabling users to create applications without extensive coding knowledge. It supports various database backends and provides a user-friendly interface for database management. However, a recent vulnerability has been identified that allows authenticated users with base-create permissions to exploit file access controls.
Vulnerability Detail
The vulnerability arises from the SQLite client and the base/integration create services, which accept user-supplied filenames without proper validation. This flaw allows an authenticated user to point to arbitrary files on the NocoDB host, including sensitive internal databases. As a result, attackers can read or overwrite files that the NocoDB process can access, leading to potential data disclosure and modification of internal states or other tenants' databases.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.05.1
This is the first release that contains the fix.
npm install nocodb@2026.05.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the NocoDB application to trusted users only, and monitor file access closely until the package is updated.
Conclusion
In summary, CVE-2026-47385 is a significant vulnerability in NocoDB that allows authenticated users to exploit file access controls, potentially leading to unauthorized data access and modification. Users are strongly advised to update to the latest version to mitigate this risk.
See every vulnerability recorded for nocodb →
FAQ
The vulnerability is a path traversal issue that allows authenticated users to access arbitrary files on the server.
Any NocoDB installation that allows authenticated users with base-create permissions is at risk.
The impacts include unauthorized access to sensitive files, potential data leakage, and modification of internal databases.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
