CVE-2026-112005
Received Received - Intake

Path Traversal in WhoDB via DuckDB Functions

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulnCheck

Description
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-112005
EUVD
EUVD-2026-103458

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
clidey whodb 0.104.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112005 is a path traversal vulnerability in WhoDB versions 0.104.0 through 0.134.0. It allows remote attackers to read and write arbitrary host files by exploiting DuckDB filesystem functions in the query editor. Attackers can access sensitive files like session.key and database credentials without authentication using functions such as read_text, read_blob, COPY ... TO, or ATTACH.

Detection Guidance

Check WhoDB version with 'whodb --version' or inspect the DuckDB plugin files in whodb/core/src/plugins/duckdb/. Look for unauthorized file access attempts in logs or monitor for suspicious SQL queries using read_text, read_blob, COPY ... TO, or ATTACH commands.

Impact Analysis

This vulnerability allows attackers to steal session keys and database credentials, read or overwrite critical files, and potentially gain unauthorized access to sensitive data. It can lead to credential theft, data breaches, or system compromise without requiring authentication.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive files, including session keys and database credentials. Attackers could read or overwrite files containing personal data or protected health information, violating data protection requirements for confidentiality and integrity.

Mitigation Strategies

Upgrade to WhoDB 0.135.0 or later immediately. If unable to upgrade, apply DuckDB settings 'enable_external_access = false' and 'lock_configuration = true' at connection time. Restrict database paths to prevent traversal and disable server mode if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112005. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart