NOCODB · CVE-2026-126293 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.06.2 trusts the content length advertised by a remote server when an attachment is uploaded by URL, so the size limit can be skipped. An authenticated Editor can store oversized files and exhaust disk space or storage quota.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host NocoDB before 2026.06.2 and let Editor-role users upload attachments by URL. The flaw is in the v3 upload path that trusts the remote server's advertised length, so instances without that endpoint exposed or with only trusted Editors are less exposed.
Not affected if no-editor-users, version-2026.06.2-or-later
Who cares nocodb, self-hosted, storage
2026.06.2.2026.06.2 or later.NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a server that understates or omits its length to exhaust disk space or storage quota.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.