Description
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token holder can invoke the function through the /v1/query HTTP endpoint, causing path.Join to resolve .. segments outside $XDG_CACHE_HOME/anyquery/plugins/ and os.RemoveAll to recursively delete any reachable directory writable by the Anyquery server process. This causes permanent data loss and denial of service without disclosing file contents. This issue is fixed in version 0.4.5.
Published: 2026-09-14
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary Directory Deletion resulting in Permanent Data Loss and Denial of Service
Action: Apply Patch
AI Analysis

Impact

Clear_plugin_cache, a scalar function in Anyquery, accepted a plugin name that was passed through path.Join to os.RemoveAll without validating for traversal segments. This flaw allowed an attacker to craft a request that resolved to directories outside the intended plugin cache location and delete them. The vulnerability is a classic path traversal (CWE‑22) that can cause irreversible data loss and server disruption without exposing file contents.

Affected Systems

Anyquery, versions earlier than 0.4.5, deployed by the vendor julien040. Any installation that exposes the /v1/query HTTP endpoint and uses bearer‑token authentication is susceptible.

Risk and Exploitability

The flaw carries a CVSS score of 7.3, indicating high impact. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Attackers holding a low‑privileged bearer token can invoke the vulnerable function over HTTP, making exploitation straightforward in exposed environments.

Generated by OpenCVE AI on September 15, 2026 at 11:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Anyquery to version 0.4.5 or later to incorporate the fix.
  • If an immediate upgrade is not possible, restrict or remove bearer‑token access to the /v1/query endpoint or disable the clear_plugin_cache function.
  • Ensure the plugin cache directory is stored in a protected location and set filesystem permissions so that the server process cannot write to directories outside the designated cache path.

Generated by OpenCVE AI on September 15, 2026 at 11:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-j9rx-rppg-6hh4 Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion
History

Mon, 14 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token holder can invoke the function through the /v1/query HTTP endpoint, causing path.Join to resolve .. segments outside $XDG_CACHE_HOME/anyquery/plugins/ and os.RemoveAll to recursively delete any reachable directory writable by the Anyquery server process. This causes permanent data loss and denial of service without disclosing file contents. This issue is fixed in version 0.4.5.
Title Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-14T20:09:37.157Z

Reserved: 2026-05-18T22:54:18.273Z

Link: CVE-2026-47253

cve-icon Vulnrichment

Updated: 2026-09-14T20:09:12.304Z

cve-icon NVD

Status : Received

Published: 2026-09-14T20:16:44.070

Modified: 2026-09-14T20:16:44.070

Link: CVE-2026-47253

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T12:00:16Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')