{"id":"EUVD-2026-77809","enisaUuid":"ba59ba83-54e7-3a97-bb81-2217ec0c6411","description":"Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.","datePublished":"Sep 14, 2026, 7:56:39 PM","dateUpdated":"Sep 15, 2026, 7:32:05 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/julien040/anyquery/security/advisories/GHSA-xrcf-6jh3-ggvx\nhttps://github.com/julien040/anyquery/commit/27f84fc168310455eaf81ec4ba87eed20298670c\nhttps://github.com/julien040/anyquery/releases/tag/0.4.5\n","aliases":"CVE-2026-50006\nGHSA-xrcf-6jh3-ggvx\n","assigner":"GitHub_M","epss":0.97,"enisaIdProduct":[{"id":"030d9eaf-d5ac-30ad-a302-82f94cdd45c1","product":{"name":"anyquery","vendor":{"name":"julien040"}},"product_version":"\u003c 0.4.5"}],"enisaIdVendor":[{"id":"6032e730-f7ec-3693-9b55-a1e6da4936bb","vendor":{"name":"julien040"}}],"enisaIdVulnerability":[{"id":"43ec0383-5faa-3a1b-a3d1-e7f2c5aafb4f","vulnerability":{"id":"GHSA-xrcf-6jh3-ggvx","description":"Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode","datePublished":"Jul 14, 2026, 6:33:57 PM","dateUpdated":"Jul 14, 2026, 6:33:57 PM","baseScore":0.0,"references":"https://github.com/julien040/anyquery/security/advisories/GHSA-xrcf-6jh3-ggvx\nhttps://github.com/julien040/anyquery\nhttps://github.com/julien040/anyquery/releases/tag/0.4.5\n","enisa_id":"EUVD-2026-77809\n","aliases":"CVE-2026-50006\nGHSA-xrcf-6jh3-ggvx\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:59:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8dc72dff-d17e-316e-9ad0-72aa32819ff1","vulnerability":{"id":"CVE-2026-50006","description":"Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.","datePublished":"Sep 14, 2026, 7:56:39 PM","dateUpdated":"Sep 15, 2026, 7:32:05 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/julien040/anyquery/security/advisories/GHSA-xrcf-6jh3-ggvx\nhttps://github.com/julien040/anyquery/commit/27f84fc168310455eaf81ec4ba87eed20298670c\nhttps://github.com/julien040/anyquery/releases/tag/0.4.5\n","enisa_id":"EUVD-2026-77809\n","assigner":"GitHub_M","epss":0.97,"dataProcessed":"Nov 9, 2026, 7:14:55 AM","vulnerabilityProduct":[{"id":"be4c11a4-4f4a-374e-b41e-45939f75ca3d","product":{"name":"anyquery","vendor":{"name":"julien040"}},"product_version":"\u003c 0.4.5"}],"vulnerabilityVendor":[{"id":"7d214198-2f83-3c2e-8045-fb305dc20d92","vendor":{"name":"julien040"}}]}}],"enisaIdAdvisory":[]}