CVE-2026-112005 Details
Description
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.
A path traversal vulnerability has been identified in WhoDB versions 0.104.0 prior to 0.135.0. This vulnerability allows remote attackers to read and write arbitrary files on the host system by executing DuckDB filesystem functions through the query editor. The issue arises because the DuckDB plugin does not properly confine file access, allowing unauthorized read and write operations to external files. Attackers can exploit this vulnerability to access sensitive information, such as the session key and database credentials, or to overwrite important files.
WhoDB has released a patch in version 0.135.0 that addresses this vulnerability by applying the necessary security settings for DuckDB connections. Users are advised to update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/clidey/whodb/security/advisories/GHSA-x3h5-pr45-fx4r | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/clidey/whodb/blob/0.134.0/core/src/plugins/duckdb/db.go#L73-L95 | [email protected] | Source CodeVendor |
| https://github.com/clidey/whodb/blob/0.134.0/core/src/plugins/duckdb/duckdb.go#L375-L387 | [email protected] | Source CodeVendor |
| https://github.com/clidey/whodb/commit/80111c9ebc2eec382222629ba9fd26236f1a40e6 | [email protected] | Source CodeVendor |
| https://github.com/clidey/whodb/releases/tag/0.135.0 | [email protected] | Release NotesVendor |
| https://github.com/clidey/whodb/security/advisories/GHSA-x3h5-pr45-fx4r | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/whodb-0.104.0-before-0.135.0-arbitrary-file-read-write-via-duckdb-query-editor | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WhoDB | >= 0.104.0, < 0.135.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |