Security readout for executives and security teams
Plain-English summary
An authenticated SurrealDB user with root, namespace, or database privileges may abuse analyzer configuration to read files accessible to the database service. Practical extraction is limited to files formatted as two-column, tab-separated data. The low severity reflects required privileges, file-format constraints, and confidentiality-only impact.
Executive priority
Schedule remediation through normal vulnerability management rather than emergency response. Prioritize internet-accessible or multi-tenant deployments and environments where non-administrators have database-level privileges or the SurrealDB process can read sensitive files. Escalate if suspicious analyzer changes or privileged-account compromise is discovered.
Technical view
CVE-2025-71394 is a CWE-22 local file-read flaw in DEFINE ANALYZER affecting SurrealDB before 2.2.2. A privileged authenticated user can direct an analyzer to an arbitrary filesystem path and potentially retrieve compatible file contents. CVSS 4.0 is 2.3; no integrity, availability, or downstream-system impact is identified.
Likely exposure
Exposure primarily exists where untrusted or insufficiently trusted users hold root, namespace, or database-level SurrealDB privileges. Risk also depends on files readable by the SurrealDB process and whether their contents match the exploitable two-column tab-separated format.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not identified as KEV. Exploitation requires authentication, elevated SurrealDB privileges, and particular file-format conditions. It is therefore more relevant to insider threats, compromised privileged accounts, or overly broad database access than anonymous attacks.
Researcher notes
The bundle identifies DEFINE ANALYZER path handling as the vulnerable surface and notes extraction constraints for two-column tab-separated files. Its structured affected-version entries are internally ambiguous, including differing upper bounds and default-unaffected labels. The title, description, and advisory reference consistently identify versions before 2.2.2; confirm branch-specific applicability with the vendor advisory.
Mitigation direction
- Upgrade SurrealDB to version 2.2.2 or later.
- Review vendor guidance before applying changes in production.
- Restrict root, namespace, and database-level privileges to trusted administrators.
- Limit the SurrealDB service account's filesystem read permissions.
- Investigate unnecessary or unexpected DEFINE ANALYZER changes.
Validation and detection
- Inventory SurrealDB instances and record their exact versions.
- Confirm every instance is running version 2.2.2 or later.
- Review accounts holding root, namespace, or database-level privileges.
- Audit analyzer definitions for unexpected filesystem paths.
- Verify the SurrealDB process cannot read unrelated sensitive files.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-71394 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
2.3LowVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-2cvj-g5r5-jrrg)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZERCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.