What is GHSA-627h-wprw-6cpg?

GHSA-627h-wprw-6cpg is a security advisory published by GitHub Security Advisories with Low severity. SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER...

Which CVE IDs does GHSA-627h-wprw-6cpg cover?

GHSA-627h-wprw-6cpg covers the following CVE IDs: CVE-2025-71394. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-627h-wprw-6cpg?

GHSA-627h-wprw-6cpg has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-627h-wprw-6cpgLowCVSS 4.3

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER...

Vendor

GitHub Security Advisories

Published

July 18, 2026

Last Modified

August 13, 2026

🔗 CVE IDs covered (1)

CVE-2025-71394 →

📋 Description

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

🔗 References (4)

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2cvj-g5r5-jrrg
https://nvd.nist.gov/vuln/detail/CVE-2025-71394
https://www.vulncheck.com/advisories/surrealdb-before-local-file-read-via-define-analyzer
https://github.com/advisories/GHSA-627h-wprw-6cpg