clidey whodb prior 0.45.0 /db Join path traversal

Summaryinfo

A vulnerability marked as critical has been reported in clidey whodb. This affects the function Join of the file /db. Performing a manipulation results in path traversal. This vulnerability is cataloged as CVE-2025-24786. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in clidey whodb. This affects the function Join of the file /db. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-35. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Affected versions of WhoDB allow users to connect to Sqlite3 databases. By default, the databases must be present in `/db/` (or alternatively `./tmp/` if development mode is enabled). If no databases are present in the default directory, the UI indicates that the user is unable to open any databases. The database file is an user-controlled value. This value is used in `.Join()` with the default directory, in order to get the full path of the database file to open. No checks are performed whether the database file that is eventually opened actually resides in the default directory `/db`. This allows an attacker to use path traversal (`../../`) in order to open any Sqlite3 database present on the system. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-24786 since 01/23/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 216199 (SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:0429-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.45.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (216199). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• clidey

Name

• whodb

Website

• Product: https://github.com/clidey/whodb/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion