SQL Injection Vulnerability in Anyquery SQL Query Engine by Julien040

CVE-2026-47253

What is CVE-2026-47253?

The Anyquery SQL query engine, prior to version 0.4.5, contains a vulnerability that permits low-privileged users to invoke the clear_plugin_cache function, allowing them to manipulate file paths. By using the /v1/query endpoint, attackers can exploit path traversal segments, leading to the recursive deletion of any directory writable by the server process. This poses a significant risk of permanent data loss and contributes to denial of service scenarios, as the affected application can lose access to critical files without revealing sensitive content.

References