SurrealDB (< 3.3.1)

SurrealDB versions 2.0.0 through 3.3.0 fail to enforce --deny-funcs restrictions on method-style function calls, allowing authenticated users to execute forbidden functions and bypass file system access controls.