CVE-2026-50006
CriticalCVSS 9.1Summary
Anyquery prior to 0.4.5 forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.
Risk Assessment
An attacker can create or overwrite arbitrary files writable by the server process, leading to data integrity loss and denial of service, and in some cases code execution.
Recommendation
Update Anyquery to version 0.4.5 or later and restrict the server process's write permissions and network access to the MySQL port.
Other vulnerabilities in Anyquery
See all- CVE-2026-54629High
Anyquery before 0.4.5 exposes file-backed SQLite virtual table modules (csv_reader, log_reader) through its MySQL-compatible server port without authentication, allowing a remote attacker to read arbitrary files from the system.
- CVE-2026-54628High
Anyquery prior to 0.4.5 exposes URL-capable SQLite virtual table modules (json_reader, log_reader) through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can supply a loopback, private-network, or link-local URL (e.g. cloud metadata), causing go-getter to fetch the resource and expose the response as queryable table data.
- CVE-2026-47253High
In Anyquery prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token holder can invoke it via the /v1/query HTTP endpoint, causing recursive deletion of any directory writable by the Anyquery server process.
Original NVD description (English source)
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.