CVE-2026-112005

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.

• CWE-22

• https://github.com/clidey/whodb/blob/0.134.0/core/src/plugins/duckdb/db.go#L73-L95
• https://github.com/clidey/whodb/blob/0.134.0/core/src/plugins/duckdb/duckdb.go#L375-L387
• https://github.com/clidey/whodb/commit/80111c9ebc2eec382222629ba9fd26236f1a40e6
• https://github.com/clidey/whodb/releases/tag/0.135.0
• https://github.com/clidey/whodb/security/advisories/GHSA-x3h5-pr45-fx4r
• https://www.vulncheck.com/advisories/whodb-0.104.0-before-0.135.0-arbitrary-file-read-write-via-duckdb-query-editor

Published

Oct 18, 2026

Last Modified

Oct 18, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11200Inappropriate implementation in WebRTC in Google Chrome prio…6.5
• CVE-2026-112000Vanus 0.8.0 through 0.9.0 contains a missing authorization v…7.6
• CVE-2026-112001ProjectSend 2.0.0 before 2.7.0 contains an incorrect authori…7.2
• CVE-2026-112002ProjectSend 2.5.0 before 2.7.0 contains an unverified passwo…6.8
• CVE-2026-112003ProjectSend 2.0.0 before 2.7.0 contains a path validation fl…5.9
• CVE-2026-112004Teable before 2026-10-12T12-45-53Z.3331 contains an authoriz…3.1
• CVE-2026-112006OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 b…6.5
• CVE-2026-112007Schism Tracker through 20260524 contains a heap out-of-bound…6.1
• CVE-2026-112008libmng through 2.0.3 contains a heap-based buffer overflow v…6.1
• CVE-2026-112009smpeg through 2.0.0 contains a heap out-of-bounds read vulne…5.5
• CVE-2026-11201Use after free in ServiceWorker in Google Chrome prior to 14…8.8
• CVE-2026-112010smpeg through 2.0.0 contains an integer underflow vulnerabil…5.5