High severity · published Sep 14, 2026
CVE-2026-47253
Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token holder can invoke the function through the /v1/query HTTP endpoint, causing path.Join to resolve .. segments outside $XDG_CACHE_HOME/anyquery/plugins/ and os.RemoveAll to recursively delete any reachable directory writable by the Anyquery server process. This causes permanent data loss and denial of service without disclosing file contents. This issue is fixed in version 0.4.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
anyquery · julien040
< 0.4.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47253
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47253
github.com
https://github.com/julien040/anyquery/commit/27f84fc168310455eaf81ec4ba87eed20298670c
github.com
https://github.com/julien040/anyquery/releases/tag/0.4.5
github.com
https://github.com/julien040/anyquery/security/advisories/GHSA-j9rx-rppg-6hh4
More from anyquery
9.1
CVE-2026-50006
Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
9.0
CVE-2026-47252
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)
8.6
CVE-2026-54628
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode
7.7
CVE-2025-61679
Anyquery Unauthenticated Access Vulnerability Exposes Private Integration Data
7.5
CVE-2026-54629
Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode