CVE-2025-24786

WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Affected versions of WhoDB allow users to connect to Sqlite3 databases. By default, the databases must be present in `/db/` (or alternatively `./tmp/` if development mode is enabled). If no databases are present in the default directory, the UI indicates that the user is unable to open any databases. The database file is an user-controlled value. This value is used in `.Join()` with the default directory, in order to get the full path of the database file to open. No checks are performed whether the database file that is eventually opened actually resides in the default directory `/db`. This allows an attacker to use path traversal (`../../`) in order to open any Sqlite3 database present on the system. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-22
• CWE-35

• https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L14-L20Product
• https://github.com/clidey/whodb/blob/ba6eb81d0ca40baead74bca58b2567166999d6a6/core/src/plugins/sqlite3/db.go#L26Product
• https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76Exploit, Vendor Advisory
• https://github.com/clidey/whodb/security/advisories/GHSA-9r4c-jwx3-3j76Exploit, Vendor Advisory

Published

Feb 6, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24780Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2025-24781Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-24782Improper Control of Filename for Include/Require Statement i…8.8
• CVE-2025-24783** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in …7.5
• CVE-2025-24784kubewarden-controller is a Kubernetes controller that allows…4.3
• CVE-2025-24785iTop is an web based IT Service Management tool. In version …4.3
• CVE-2025-24787WhoDB is an open source database management tool. In affecte…7.5
• CVE-2025-24788snowflake-connector-net is the Snowflake Connector for .NET.…5.5
• CVE-2025-24789Snowflake JDBC provides a JDBC type 4 driver that supports c…7.8
• CVE-2025-2479The Easy Custom Admin Bar plugin for WordPress is vulnerable…6.1
• CVE-2025-24790Snowflake JDBC provides a JDBC type 4 driver that supports c…5.5
• CVE-2025-24791snowflake-connector-nodejs is a NodeJS driver for Snowflake.…5.5