Key points
- The flaw affects WhoDB 0.104.0 through versions prior to 0.135.0.
- Attackers can use DuckDB functions to read or write files on the host.
- Versions 0.135.0 and later are not affected by this vulnerability.
Security operations teams must identify all instances of WhoDB running versions older than 0.135.0 immediately. The software contains a critical path traversal vulnerability that enables remote attackers to interact with the host filesystem. This issue allows for both reading and writing arbitrary files, creating a severe risk to system integrity and data confidentiality.
In plain English
The vulnerability stems from how the query editor handles DuckDB filesystem functions. An attacker does not need valid login credentials to exploit this flaw. They can simply connect to a DuckDB file and execute commands such as read_text or read_blob. These commands allow the attacker to steal sensitive information, including session keys and stored database credentials.
The background
The National Vulnerability Database records this issue as CVE-2026-112005 with a CVSS score of 9.2, classifying it as critical. The weakness aligns with CWE-22, which covers path traversal errors. As Vuln Post reported on 2026-10-13, similar path traversal flaws in Wazuh allowed cluster workers to write arbitrary files, highlighting the persistent risk of this bug class.
What changes now
The immediate priority is isolating affected WhoDB instances from untrusted networks. Teams should restrict access to the query editor. Organizations must audit their DuckDB file permissions and monitor for unauthorized file access attempts. Any signs of data exfiltration require immediate incident response procedures. Users should upgrade to version 0.135.0 or later to resolve the issue.
Who needs to act first
Teams should prioritize systems exposed to the internet or untrusted internal networks. Begin by isolating these instances from general network traffic to prevent remote exploitation. Check whether the query editor is accessible to users without strict authentication controls. Verify that file permissions on the host restrict who can read or write to database directories. Implement temporary network restrictions to block external access while planning the upgrade.
What to do and how to stay safe: WhoDB
- Restrict network access to WhoDB instances to prevent unauthenticated remote connections.
- Monitor system logs for unusual file access patterns or attempts to read sensitive credentials.
- Disable the query editor feature if it is not essential for current operations.
- Upgrade to WhoDB version 0.135.0 or later as soon as possible.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of WhoDB are affected by this vulnerability?
Versions 0.104.0 through any version before 0.135.0 are affected.
Can attackers exploit this flaw without logging in?
Yes, attackers can log in to a DuckDB file without credentials to execute malicious commands.
Is there a fix available for CVE-2026-112005?
The vulnerability exists in versions before 0.135.0, implying that version 0.135.0 resolves the issue.
