Anyquery is an SQL query engine that forwards raw SQL from its MySQL‑compatible server port to SQLite. Until version 0.4.5, the engine did not constrain the ATTACH DATABASE command, allowing an unauthenticated attacker to specify any filesystem path writable by the server process. SQLite then creates or overwrites a database file at that location with attacker‑controlled table data. This leads to arbitrary file creation or overwrite, which can degrade filesystem integrity, cause denial of service, and, if a privileged writable location or another interpreter is involved, can lead to remote code execution. The flaw corresponds to several common weaknesses: improper file permissions, arbitrary write, and authentication bypass.

The product affected is Anyquery, a server‑side SQL engine built on SQLite by the vendor julien040. All releases before 0.4.5 are vulnerable. The vulnerability is mitigated in any release 0.4.5 or later.

The CVSS score for this issue is 9.1, indicating a high‑severity attack path. While the EPSS score is not available, the flaw remains serious because it allows unauthenticated remote execution via the database server port. The flaw is not listed in the CISA KEV catalog, but the absence of an exploit probability metric does not diminish the potential impact. A remote attacker can exploit this through the MySQL‑compatible interface, which is typically exposed on TCP port 3306, and since no authentication is required, the attack vector to a target path that is writable by the Anyquery process; if that path is privileged or subsequently interpreted by another service, remote code execution can occur.