Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-112005— WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor

Quick assessment

Affected

clidey whodb

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WhoDB 0.104.0 至 0.135.0 之前的版本存在路径遍历漏洞。远程攻击者可通过查询编辑器执行 DuckDB 文件系统函数，从而读取和写入任意主机文件。攻击者可在无需凭证的情况下登录 DuckDB 文件，并利用、、或等函数窃取和存储的数据库凭证，或覆盖文件。

CVSS 7.7 · High Updated Oct 18, 2026

Possible ATT&CK Techniques 3 AI

T1003 · OS Credential Dumping T1083 · File and Directory Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor

Source: CVE Program / CVE List V5

Vulnerability Description

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
clidey	whodb	0.104.0 ~ 0.135.0	-

II. Public POCs for CVE-2026-112005

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-112005

请登录查看更多情报信息。

Other References for CVE-2026-112005 (6)

🔗 whodb/core/src/plugins/duckdb/db.go at 0.134.0 · clidey/whodb · GitHub technical-description
🔗 whodb/core/src/plugins/duckdb/duckdb.go at 0.134.0 · clidey/whodb · GitHub Read full article technical-description
🔗 duckdb patch fix · clidey/whodb@80111c9 · GitHub Read full article patch
🔗 Release Release 0.135.0 · clidey/whodb · GitHub release-notes
🔗 Unauthenticated arbitrary host file read and write through a DuckDB source session, disclosing every logged-in user's database credential in plaintext · Advisory · clidey/whodb · GitHub Read full article vendor-advisory
🔗 WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-112005

IV. Related Vulnerabilities

Same product: whodb

Same vendor: clidey

Same weakness: CWE-22

V. Comments for CVE-2026-112005

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-112005— WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor

Quick assessment

Possible ATT&CK Techniques 3 AI

I. Basic Information for CVE-2026-112005

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-112005

III. Intelligence Information for CVE-2026-112005

Other References for CVE-2026-112005 (6)

IV. Related Vulnerabilities

V. Comments for CVE-2026-112005

Leave a comment