Authenticated file read via LOAD CSV

Arbitrary file read in OpenCypher in Arcade Data ArcadeDB before 26.8.1 allows remote authenticated users to read local files via LOAD CSV. The LOAD CSV FROM file:// path performs no per-statement authorization check for ordinary read-query users, and when the import directory is unset it passes the supplied path unchanged to FileInputStream with server-process privileges. Exploitation requires valid credentials with query access, such as the built-in readonly role, and exposes any host file readable by the ArcadeDB service account directly in query results.