Read the docs
TI-2026-34836 Aliases CVE-2026-47253GHSA-j9rx-rppg-6hh4

Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion

Priority HIGH 65CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token holder can invoke the function through the /v1/query HTTP endpoint, causing path.Join to resolve .. segments outside $XDG_CACHE_HOME/anyquery/plugins/ and os.RemoveAll to recursively delete any reachable directory writable by the Anyquery server process. This causes permanent data loss and denial of service without disclosing file contents. This issue is fixed in version 0.4.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Fix Fixed anyquery (julien040): 0.4.5github.com/julien040/anyquery (Go): 0.4.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
julien040anyquerybefore 0.4.50.4.5Patch availableCNA
—github.com/julien040/anyquery (Go)before 0.4.50.4.5Patch availableGHSA-j9rx-rppg-6hh4
  • anyquery Vendorjulien040 Affected before 0.4.5 Fixed in 0.4.5 Patch available CNA
  • github.com/julien040/anyquery (Go) Vendor— Affected before 0.4.5 Fixed in 0.4.5 Patch available GHSA-j9rx-rppg-6hh4

Remediation

  • Fix · CNA anyquery (julien040) Fixed in 0.4.5
  • Fix · GHSA-j9rx-rppg-6hh4 github.com/julien040/anyquery (Go) Fixed in 0.4.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47253
  2. 2026-10-03 Alias added: GHSA-j9rx-rppg-6hh4

References

Other 4

  • TI-2026-36832 Path traversal in julien040 anyquery CVSS 3.1CRITICAL 9.1
  • TI-2026-39459 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode CVSS 3.1HIGH 8.6
  • TI-2026-34835 Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari) CVSS 3.1CRITICAL 9.0
  • TI-2025-38111 Anyquery Unauthenticated Access Vulnerability Exposes Private Integration Data CVSS 3.1HIGH 7.7
  • TI-2026-39460 Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences