Read the docs
TI-2026-39460 Aliases CVE-2026-54629GHSA-mf78-3rpf-r784

Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

Priority MEDIUM 41CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22, CWE-284 and the CVSS impact.

Summary

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can use SQLite CREATE VIRTUAL TABLE statements to provide a local path to these modules, which use hashicorp/go-getter under the Anyquery server process and return the selected file contents as queryable table rows. The disclosure is limited only by the filesystem permissions of the server process and can expose system configuration, credentials, and private keys. This issue is fixed in version 0.4.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00966 61st percentileScored 2026-11-07
Fix Fixed anyquery (julien040): 0.4.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
julien040anyquerybefore 0.4.50.4.5Patch availableCNA
—github.com/julien040/anyquery (Go)all versions—No fix listedGHSA-mf78-3rpf-r784
  • anyquery Vendorjulien040 Affected before 0.4.5 Fixed in 0.4.5 Patch available CNA
  • github.com/julien040/anyquery (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-mf78-3rpf-r784

Remediation

  • Fix · CNA anyquery (julien040) Fixed in 0.4.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54629
  2. 2026-10-03 Alias added: GHSA-mf78-3rpf-r784

References

Other 4

  • TI-2026-36832 Path traversal in julien040 anyquery CVSS 3.1CRITICAL 9.1
  • TI-2026-39459 Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode CVSS 3.1HIGH 8.6
  • TI-2026-34835 Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari) CVSS 3.1CRITICAL 9.0
  • TI-2025-38111 Anyquery Unauthenticated Access Vulnerability Exposes Private Integration Data CVSS 3.1HIGH 7.7
  • TI-2026-34836 Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences