SQL Query Engine Vulnerability in Anyquery by Julien040

CVE-2026-50006

What is CVE-2026-50006?

Anyquery, an SQL query engine that runs atop SQLite, is susceptible to a vulnerability that allows unauthenticated SQL commands to be forwarded to SQLite without proper restrictions on ATTACH DATABASE filesystem paths. This flaw permits an attacker to write arbitrary database files to locations accessible by the Anyquery server. Consequently, this leads to potential filesystem integrity loss and denial of service. Although remote code execution is a risk, it can only occur if the newly created file is interpreted by another service or if the process has accessible writable targets with sufficient privileges. The issue was addressed in Anyquery version 0.4.5, enhancing the overall security posture of the software.

References