cve.nowby Sazabi
← All vulnerabilities
CVE-2026-112005GHSA-X3H5-PR45-FX4R

WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV

Summary

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.

Affected versions

  • clidey whodb

    From 0.104.0 · fixed in 0.135.0

References 6

GitHub · clidey/whodb

vulncheck.com