CVE-2024-41672

DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other similar functions do NOT provide access. There seem to be two vectors to this vulnerability. First, access to files that should otherwise not be allowed. Second, the content from a file can be read (e.g. `/etc/hosts`, `proc/self/environ`, etc) even though that doesn't seem to be the intent of the sniff_csv function. A fix for this issue is available in commit c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8a and is expected to be part of version 1.1.0.

• CWE-200

• https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8aPatch
• https://github.com/duckdb/duckdb/pull/13133Patch
• https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2qExploit, Third Party Advisory
• https://github.com/duckdb/duckdb/commit/c9b7c98aa0e1cd7363fe8bb8543a95f38e980d8aPatch
• https://github.com/duckdb/duckdb/pull/13133Patch
• https://github.com/duckdb/duckdb/security/advisories/GHSA-w2gf-jxc9-pf2qExploit, Third Party Advisory

Published

Jul 24, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41666Argo CD is a declarative, GitOps continuous delivery tool fo…6.5
• CVE-2024-41667OpenAM is an open access management solution. In versions 15…8.8
• CVE-2024-41668The cBioPortal for Cancer Genomics provides visualization, a…8.3
• CVE-2024-4167A vulnerability was found in Tenda 4G300 1.01.42 and classif…8.8
• CVE-2024-41670In the module "PayPal Official" for PrestaShop 7+ releases p…7.5
• CVE-2024-41671Twisted is an event-based framework for internet application…8.3
• CVE-2024-41673Decidim is a participatory democracy framework. The version …7.1
• CVE-2024-41674CKAN is an open-source data management system for powering d…5.3
• CVE-2024-41675CKAN is an open-source data management system for powering d…6.1
• CVE-2024-41676Magento-lts is a long-term support alternative to Magento Co…4.8
• CVE-2024-41677Qwik is a performance focused javascript framework. A potent…6.1
• CVE-2024-41678GLPI is a free asset and IT management software package. An …6.1