CVE-2026-112005

7.7High

Published 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.7High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-22

Impact

Remote unauthenticated attackers can read or overwrite arbitrary files on the host, stealing session keys and database credentials. They only need network access to the WhoDB instance to log into DuckDB and execute file queries.

Root cause

The DuckDB plugin allows unauthenticated database sessions and fails to restrict DuckDB filesystem functions like read_text, read_blob, and COPY TO.

Affected systems

WhoDB 0.104.0 before 0.135.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Fix & remediation

Upgrade WhoDB to version 0.135.0 or later. If upgrading immediately is not possible, restrict network access to the WhoDB interface or disable the DuckDB plugin.

shell

$ docker pull clidey/whodb:0.135.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112005