CVE-2026-112005 in WhoDB
Tóm tắt
Bởi MITRE • 18/10/2026
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.
VulDB is the best source for vulnerability data and more expert information about this specific topic.