CVE-2026-50006
Received Received - Intake

Arbitrary File Creation in Anyquery via ATTACH DATABASE

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-50006

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
anyquery anyquery 0.4.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Anyquery before version 0.4.5 forwards unauthenticated SQL from its MySQL-compatible port to SQLite without restricting ATTACH DATABASE filesystem targets. This allows attackers to create or overwrite files on the server by writing SQLite database files to arbitrary writable paths.

Detection Guidance

Check if anyquery server is running version 0.4.5 or later. Inspect network traffic for unauthenticated SQL commands targeting the MySQL-compatible port. Look for unexpected file creation or modification in writable directories by the anyquery process.

Impact Analysis

An attacker could exploit this to overwrite critical system files, create malicious cron jobs, or place web shells if the Anyquery process has sufficient permissions. This leads to potential denial of service, data corruption, or remote code execution depending on the environment.

Compliance Impact

This vulnerability compromises data integrity and availability, which are core requirements under GDPR and HIPAA. Unauthorized file creation or modification could lead to data breaches, loss of confidentiality, or system unavailability, violating compliance obligations.

Mitigation Strategies

Upgrade anyquery to version 0.4.5 or later immediately. Disable the ATTACH DATABASE command in server mode and restrict the MySQL handler to prevent unauthorized file operations. Ensure the anyquery process runs with minimal privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart