{"id":"CVE-2026-112005","summary":"WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor","details":"WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.","aliases":["GHSA-x3h5-pr45-fx4r"],"modified":"2026-10-19T02:45:49.806869030Z","published":"2026-10-18T11:38:29.173Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112005.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112005.json"},{"type":"PACKAGE","url":"https://github.com/clidey/whodb"},{"type":"ARTICLE","url":"https://github.com/clidey/whodb/blob/0.134.0/core/src/plugins/duckdb/db.go#L73-L95"},{"type":"ARTICLE","url":"https://github.com/clidey/whodb/blob/0.134.0/core/src/plugins/duckdb/duckdb.go#L375-L387"},{"type":"FIX","url":"https://github.com/clidey/whodb/commit/80111c9ebc2eec382222629ba9fd26236f1a40e6"},{"type":"ADVISORY","url":"https://github.com/clidey/whodb/releases/tag/0.135.0"},{"type":"ADVISORY","url":"https://github.com/clidey/whodb/security/advisories/GHSA-x3h5-pr45-fx4r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112005"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/whodb-0.104.0-before-0.135.0-arbitrary-file-read-write-via-duckdb-query-editor"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/clidey/whodb","events":[{"introduced":"31544f3dd040c1a1b70ad04f925913bd5e088ca8"},{"fixed":"ee9725580a5aa179c25f9bd5699694675e715689"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.104.0"},{"fixed":"0.135.0"}]}}],"versions":["0.134.0","0.133.0","0.132.0","0.129.0","0.128.0","sdk/packages/go/v0.127.3","0.127.0","0.126.0","0.125.0","0.124.0","0.123.0","0.122.0","0.121.0","0.120.0","0.119.0","0.118.0","0.117.0","0.116.0","0.115.0","0.114.0","0.112.0","0.111.0","0.110.0","0.109.0","0.108.0","0.107.0","0.106.0","0.105.0","0.104.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112005.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"}]}