WhoDB 0.104.0 Path Traversal Flaw Lets Attackers Access Host Files

WhoDB versions prior to 0.135.0 contain a critical path traversal vulnerability that allows remote attackers to read and write arbitrary host files, according to the National Vulnerability Database record for CVE-2026-112005. The flaw enables attackers to execute DuckDB filesystem functions through the application’s query editor without providing any credentials.

The vulnerability is classified as critical with a CVSS score of 9.2 and is associated with CWE-22. Attackers can log in to a DuckDB file without credentials and use specific functions such as read_text, read_blob, COPY ... TO, or ATTACH. These functions allow the reading of sensitive data like session.key and stored database credentials, or the overwriting of existing files on the host system.

Technical Context and Attack Vector

The National Vulnerability Database describes the weakness as a path traversal vulnerability inherent in WhoDB 0.104.0 and subsequent versions before 0.135.0. The core issue lies in how the query editor handles filesystem functions. By leveraging these functions, a remote attacker can bypass standard authentication mechanisms entirely. This lack of credential requirement significantly lowers the barrier for exploitation.

Attackers can utilize the read_text function to extract plain text data from the host filesystem. Alternatively, the read_blob function can be used to retrieve binary data. The COPY ... TO command allows for writing data to specific locations, while the ATTACH command can be used to connect to other databases or files. This combination of read and write capabilities poses a severe risk to system integrity and confidentiality.

Affected Software and Scope

The vulnerability affects WhoDB software created by clidey. Any installation running version 0.104.0 or any version up to, but not including, 0.135.0 is vulnerable to this exploit. The NVD record explicitly lists the affected range as "clidey whodb before 0.135.0". Users of these versions are exposed to the risk of unauthorized file access and modification.

The impact includes the theft of session keys and stored database credentials. These credentials can be used for further lateral movement or persistent access within the compromised environment. The ability to overwrite files also introduces the potential for denial of service or the injection of malicious code into the system.

What should you do?

Organizations using WhoDB should immediately check their current version against the affected range. If the installed version is prior to 0.135.0, users should monitor for official vendor updates that address CVE-2026-112005. Until a patch is confirmed, consider restricting network access to the query editor interface to minimize the attack surface. Monitor system logs for unusual file access patterns or unexpected database attachments that may indicate exploitation attempts.