Description
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.
Published: 2026-10-18
Score: 9.2 Critical
EPSS: n/a
KEV: No
Impact: Remote file read/write
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows remote attackers to execute DuckDB filesystem functions through the query editor, enabling the read and write of arbitrary host files without authentication. This path traversal flaw can expose sensitive data such as session keys and database credentials or overwrite critical system files, leading to a loss of confidentiality and integrity.

Affected Systems

Any machine running the Clidey whoDB product with a DuckDB query editor is affected. Versions 0.104.0 through 0.134.x are vulnerable; the issue is resolved in releases 0.135.0 and later.

Risk and Exploitability

The CVSS score of 9.2 marks the flaw as critical. Though EPSS data is unavailable, the lack of authentication and unrestricted file access suggest a high likelihood of exploitation. The vulnerability is not listed in CISA KEV, and attackers can exploit it by connecting to the whoDB instance and issuing a DuckDB query that includes filesystem functions.

Generated by OpenCVE AI on October 18, 2026 at 12:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update whoDB to version 0.135.0 or later.
  • If an upgrade is not possible immediately, disable the DuckDB query editor or restrict network access to the whoDB instance until the fix is applied.
  • Ensure that no external users have access to the query editor interface while the issue remains unresolved.

Generated by OpenCVE AI on October 18, 2026 at 12:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.
Title WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor
First Time appeared Clidey
Clidey whodb
Weaknesses CWE-22
CPEs cpe:2.3:a:clidey:whodb:*:*:*:*:*:*:*:*
Vendors & Products Clidey
Clidey whodb
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Clidey Whodb
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-18T11:38:29.173Z

Reserved: 2026-10-18T01:23:28.881Z

Link: CVE-2026-112005

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T12:17:12.790

Modified: 2026-10-18T12:17:12.790

Link: CVE-2026-112005

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T12:30:14Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')