Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-112005: WhoDB can let attackers read or modify any file
CVE-2026-112005 · published today
Summary
Versions of WhoDB from 0.104.0 up to but not including 0.135.0 let a remote user run special database commands that can access any file on the server. This could expose secret keys, credentials, or allow the attacker to change important files. Upgrade to version 0.135.0 or later, and restrict access to the query editor to trusted users.
What to do
- Update clidey whodb to version 0.135.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| clidey | whodb | < 0.135.0 |
Original advisory text
WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.
References
- https://github.com/clidey/whodb/blob/0.134.0/core/src/plugins/duckdb/db.go#L73-L... Third Party Advisory
- https://github.com/clidey/whodb/commit/80111c9ebc2eec382222629ba9fd26236f1a40e6 Patch
- https://github.com/clidey/whodb/releases/tag/0.135.0 Vendor Advisory
- https://github.com/clidey/whodb/blob/0.134.0/core/src/plugins/duckdb/duckdb.go#L... Third Party Advisory
- https://www.vulncheck.com/advisories/whodb-0.104.0-before-0.135.0-arbitrary-file... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-1120... Vendor Advisory
- https://github.com/clidey/whodb Product
- https://github.com/clidey/whodb/security/advisories/GHSA-x3h5-pr45-fx4r Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-112005 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-22Path Traversal
Timeline
Published18 Oct 2026
Updated19 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-112005 · NVD
CVE-2026-112005 · MITRE
CVE-2026-112005 · OSV
GHSA-x3h5-pr45-fx4r · GHSA
Track software like this
Free during beta