CVE-2026-112005: WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use readtext, readblob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker who can reach the WhoDB query editor can exploit it by logging in to a DuckDB file without credentials. No pre-existing account or user interaction is required.
Which deployments are affected?
WhoDB versions from 0.104.0 up to, but not including, 0.135.0 are affected. The exposed functionality is the DuckDB query editor.
What access can an attacker obtain?
An attacker can use DuckDB filesystem functions to read arbitrary host files, including session.key and stored database credentials. They can also write or overwrite host files using functions and statements such as COPY ... TO or ATTACH.
What should be done if upgrading is not immediately possible?
Restrict remote access to the WhoDB query editor, particularly access that permits connecting to DuckDB files. This reduces the opportunity for unauthenticated attackers to execute the filesystem operations described.