CVE-2026-50006 Details
Description
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.
A vulnerability in Anyquery prior to version 0.4.5 allows unauthenticated attackers to exploit the SQLite integration of the Anyquery server. The issue arises because the server does not restrict the ATTACH DATABASE command, enabling attackers to write arbitrary database files to any writable path on the filesystem. This could lead to overwriting critical files or creating new ones with malicious content, causing a denial-of-service or, under certain conditions, remote code execution. The vulnerability is present in Anyquery's server mode, where incoming SQL commands are blindly forwarded to SQLite.
Users are advised to update to Anyquery version 0.4.5, which includes a patch for this vulnerability. The latest version can be downloaded from the Anyquery GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/julien040/anyquery/security/advisories/GHSA-xrcf-6jh3-ggvx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/julien040/anyquery/commit/27f84fc168310455eaf81ec4ba87eed20298670c | [email protected] | Source CodeVendor |
| https://github.com/julien040/anyquery/releases/tag/0.4.5 | [email protected] | Release NotesVendor |
| https://github.com/julien040/anyquery/security/advisories/GHSA-xrcf-6jh3-ggvx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Anyquery | <= 0.4.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |