by Kastro
Paper/Archive/CVE-2026-50006

CVE-2026-50006

julien040 anyquery — Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

EPSS 1.0%public exploitCVSS 9.1
critical.is priorityof 100
50
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 62.0.620 × 2012.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.

Affected

ProductAffectedFixed inSource
anyquery< 0.4.5–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/julien040/anyquery/security/advisories/GHSA-xrcf-6jh3-ggvxrefgithub.com/julien040/anyquery/commit/27f84fc168310455eaf81ec4ba87eed20298670crefgithub.com/julien040/anyquery/releases/tag/0.4.5