Path Traversal Vulnerability in WhoDB Product by Clidey

CVE-2026-112005

What is CVE-2026-112005?

WhoDB versions prior to 0.135.0 are susceptible to a path traversal vulnerability that permits remote attackers to exploit DuckDB filesystem functions through the query editor. This exploitation allows unauthorized reading and writing of arbitrary host files. By accessing a DuckDB file without authentication, attackers can utilize functions such as read_text, read_blob, and COPY ... TO for extracting sensitive information like session keys and database credentials, or for overwriting critical files on the host system.

References