{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-112005/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:whodb:whodb:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-112005"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WhoDB (\u003c 0.135.0)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","web-vulnerability","whodb","cve-2026-112005"],"_cs_type":"advisory","_cs_vendors":["WhoDB"],"content_html":"\u003cp\u003eWhoDB versions 0.104.0 through 0.134.x contain a critical path traversal vulnerability, tracked as CVE-2026-112005. The flaw originates from the insecure exposure of DuckDB filesystem functions within the application's query editor interface. An unauthenticated attacker can exploit this by executing specific DuckDB SQL functions to bypass intended directory restrictions. By leveraging functions such as read_text, read_blob, COPY, or ATTACH, an attacker can read arbitrary sensitive files on the host filesystem, including session keys and database credentials. Furthermore, the vulnerability allows for file overwriting, potentially facilitating code execution or persistence by modifying configuration files or binary assets. This vulnerability is particularly concerning because the query interface does not require authentication to execute these file-system operations, granting direct access to the underlying host OS from the application layer.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a network-exposed instance of WhoDB (version \u0026lt; 0.135.0).\u003c/li\u003e\n\u003cli\u003eAttacker accesses the web-based query editor interface without providing authentication credentials.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a SQL query using DuckDB's filesystem functions, specifically targeting sensitive files like session.key or configuration files.\u003c/li\u003e\n\u003cli\u003eAttacker executes the malicious query via the POST endpoint associated with the query editor.\u003c/li\u003e\n\u003cli\u003eThe application backend processes the request and invokes the underlying DuckDB filesystem driver with attacker-controlled path arguments.\u003c/li\u003e\n\u003cli\u003eThe application returns the contents of the requested file or performs the requested write/overwrite operation on the host filesystem.\u003c/li\u003e\n\u003cli\u003eAttacker exfiltrates the contents of the read file (e.g., credentials) via the web interface response or achieves persistence by overwriting a target file.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote attackers to perform arbitrary file reads and writes on the host running the WhoDB service. This can lead to the complete compromise of database credentials, leakage of session keys, and potential remote code execution through the overwriting of executable or configuration files. Organizations running public-facing WhoDB instances are at immediate risk of full server takeover.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch immediately by upgrading all WhoDB instances to version 0.135.0 or later.\u003c/li\u003e\n\u003cli\u003eIf an upgrade is not immediately feasible, restrict access to the WhoDB query editor interface using network-level controls (e.g., VPN or firewall IP allowlisting) to ensure only authorized personnel can access the application.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for HTTP POST requests to the query editor endpoint that contain suspicious SQL keywords such as 'read_text', 'read_blob', 'COPY', or 'ATTACH' in the request body.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-18T12:21:39Z","date_published":"2026-10-18T12:21:39Z","id":"https://feed.craftedsignal.io/briefs/2026-10-whodb-path-traversal/","summary":"WhoDB versions prior to 0.135.0 are vulnerable to path traversal via DuckDB filesystem functions in the query editor, enabling remote unauthenticated file read and write access.","title":"WhoDB Path Traversal Vulnerability (CVE-2026-112005)","url":"https://feed.craftedsignal.io/briefs/2026-10-whodb-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-112005","version":"https://jsonfeed.org/version/1.1"}