🎯 New Report #3780695: SELECT ... INTO OUTFILE does not enforce the FILE WRITE privilege unprivileged arbitrary file write on the server
🔺Severity: High
👽 Reporter: bisht-ji
⭐️ Reputation: 163
🛠 State: resolved
💼 Team: SingleStore
💵 Bounty: null
🕐 Submitted: 2026-06-03
⏰ Disclosed: 2026-07-13 19:35:07
📝 Summary: A security vulnerability was reported in SingleStore's self-managed database server where the SELECT...INTO OUTFILE command did not properly enforce the FILE WRITE privilege. This allowed any authenticated user, including those with only USAGE privileges, to write arbitrary files to the aggregator host at any path, written as the engine OS user. The vulnerability affected default-configuration self-managed deployments, but was not present in SingleStore Helios due to the local file system access restricted setting. The issue was patched by the vendor and the fix will be reflected in the next patch versions of supported SingleStoreDB releases.
📂 Report JSON File: 3780695
@hackeronereports