CVE-2026-126293 | NocoDB up to 2026.06.1 Upload Endpoint data-attachment-v3.service.ts unrestricted upload

November 13, 2026 Yanac

A vulnerability was found in NocoDB up to 2026.06.1. It has been rated as critical. This issue affects some unknown processing of the file data-attachment-v3.service.ts of the component Upload Endpoint. Performing a manipulation results in unrestricted upload.

This vulnerability is reported as CVE-2026-126293. The attack is possible to be carried out remotely. No exploit exists.

Upgrading the affected component is advised.VulDB Recent EntriesRead More