Path Traversal Vulnerability in WhoDB Open Source Database Management Tool
CVE-2025-24786

10CRITICAL

Key Information:

Vendor: Clidey
Status: Whodb
Vendor: CVE Published:; 6 February 2025

What is CVE-2025-24786?

CVE-2025-24786 is a significant vulnerability found in WhoDB, an open-source database management tool developed by Clidey. This tool is designed to facilitate the management and interaction with Sqlite3 databases. The vulnerability stems from inadequate path traversal prevention, allowing unauthenticated attackers to access and potentially manipulate any Sqlite3 database stored on the host machine where WhoDB is deployed. This oversight can pose serious risks to organizations, as it opens the door to unauthorized access to sensitive data, leading to possible data breaches and integrity issues.

Technical Details

The vulnerability arises from the way WhoDB processes user input for database file paths. Although the application is intended to restrict database access to files located within a default directory (/db or ./tmp in development mode), it fails to implement necessary checks to ensure the integrity of this access. By exploiting path traversal techniques (using sequences like ../../), attackers can circumvent these restrictions and gain access to any Sqlite3 database on the system. This issue affects specific versions of WhoDB and can be mitigated by upgrading to version 0.45.0, which addresses the vulnerability.

Potential Impact of CVE-2025-24786

Unauthorized Data Access: Attackers can exploit this vulnerability to gain access to sensitive databases, potentially exposing confidential information stored within them, such as user data or financial records.
Data Integrity Risks: The lack of access controls could allow unauthorized modifications to database content, compromising data integrity and leading to incorrect information being stored or displayed by applications relying on the affected databases.
Compliance and Legal Consequences: Organizations that suffer data breaches due to this vulnerability could face significant regulatory penalties, loss of customer trust, and damage to brand reputation, all stemming from their failure to secure sensitive data effectively.