CVE-2021-47714 Hasura GraphQL 1.3.3 Local File Read via SQL Injection
Attackers can read arbitrary system files on the server by exploiting SQL injection in the Hasura GraphQL query endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47714?
CVE-2021-47714 is a medium-severity SQL injection vulnerability in Hasura GraphQL, published on 22 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attackers can exploit the pg_read_file() PostgreSQL function by crafting malicious SQL queries to read arbitrary files on the server.
Weakness: CWE-89
Which versions are affected by CVE-2021-47714?
It affects 1 product.
Products include Hasura Graphql Engine.
How do I fix CVE-2021-47714?
No fix has been published for CVE-2021-47714 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-47714 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47714 exists.
Other vulnerabilities in Hasura GraphQL
- CVE-2021-47748 Hasura GraphQL 1.3.3 - Remote Code Execution
- CVE-2022-46792 Missing authorization in n/a
- CVE-2021-47713 Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query
- CVE-2023-27588 Unauthenticated path traversal vulnerability in Hasura GraphQL Engine
- CVE-2019-1020015 Auth bypass in graphql-engine
Sources
Also known as GHSA-rghc-mxjc-cmxr.