CVE-2025-71392
Full vulnerability record from the local CVENow database.
Description
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.
Severity
CRITICAL
CVSS score
9.4
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-18 14:17:10.580000
Last modified
2026-10-29 21:17:05.793000
View original CVE JSON
{
"id": "CVE-2025-71392",
"sourceIdentifier": "[email protected]",
"published": "2026-07-18T14:17:10.580",
"lastModified": "2026-10-29T21:17:05.793",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized."
},
{
"lang": "es",
"value": "SurrealDB antes de 2.0.5, 2.1.x antes de 2.1.5, y 2.2.x antes de 2.2.2 no logra escapar correctamente los nombres de tablas y campos en el comando de exportación de línea de comandos. Un Usuario del Sistema autenticado con roles de PROPIETARIO o EDITOR puede crear tablas o campos con nombres maliciosos que contienen SurrealQL. Cuando un usuario con mayores privilegios importa posteriormente la copia de seguridad exportada, el SurrealQL inyectado se ejecuta, lo que permite la escalada de privilegios y la toma de control a nivel de root de la instancia de SurrealDB. Las aplicaciones que permiten a los usuarios definir tablas o campos personalizados también están expuestas a una inyección universal de SurrealQL de segundo orden incluso cuando los parámetros de consulta están saneados."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "surrealdb",
"product": "surrealdb",
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"versions": [
{
"version": "2.2.0",
"lessThan": "2.2.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.2.2",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "surrealdb",
"product": "surrealdb",
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"versions": [
{
"version": "2.1.0",
"lessThan": "2.1.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.1.5",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "surrealdb",
"product": "surrealdb",
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"versions": [
{
"version": "0",
"lessThan": "2.0.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.0.5",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-21T02:39:28.967494Z",
"id": "CVE-2025-71392",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-77"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.5",
"matchCriteriaId": "D8978D31-3395-4155-8DFF-99FED3F8D7DA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.1.0",
"versionEndExcluding": "2.1.5",
"matchCriteriaId": "0D7A2AEC-83EE-46CC-BC91-D5EA1B841E96"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.2.0",
"versionEndExcluding": "2.2.2",
"matchCriteriaId": "B4D2EDCC-A5D1-477A-ADA9-A32389A7D0BE"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/surrealdb-before-surrealql-injection-via-export",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}