External risk intelligence

WhoDB Path Traversal Via DuckDB Query Editor

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-112005

WhoDB is a database management interface that includes a query editor. Such tools are commonly deployed as web-based administrative consoles. Given that the vulnerability exists within the application's query editor interface, which is designed to be accessed and used by operators, it is frequently exposed in environments where web-based database management is required.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in WhoDB's query editor allows attackers to read and write files on a host system by exploiting DuckDB functions. This could potentially lead to the exposure of sensitive data, such as session keys and database credentials. The main concern is confirming relevance and exposure within your environment.

Path traversal allows arbitrary file access.
Sensitive data theft or modification is possible.
Confirm relevance and exposure for leadership.

Attack Path

How an attacker could exploit the issue

An attacker can begin by accessing the WhoDB query editor, which does not require authentication. From there, they can leverage DuckDB filesystem functions to read or write arbitrary files on the host system. This could allow them to steal sensitive information like session keys and stored credentials or modify critical files.

No credentials needed for access.
Triggered by DuckDB filesystem functions.
Risk of data theft or file overwrites.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to read or write arbitrary files on the host system by exploiting the DuckDB filesystem functions through the query editor. Supported conditions include when the DuckDB filesystem functions are exposed via the query editor, enabling an attacker to potentially steal sensitive session information or credentials, or overwrite critical files.

Host files and sensitive credentials.
Through the DuckDB query editor.
Unauthorized file access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts WhoDB, a database management interface, particularly its DuckDB filesystem functions accessible through the query editor. Given the nature of this tool, application owners and platform teams are likely responsible for its deployment and maintenance. The immediate first step should be to identify all instances of WhoDB within the environment, determine their business criticality and network exposure, and then locate the accountable owner to plan a risk-based remediation strategy.

Application owners must verify WhoDB instances.
Confirm network exposure and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WhoDB?

WhoDB is a database management interface that provides a web-based query editor. It is primarily used by developers and database administrators to interact with, manage, and execute queries against various database systems through a centralized console.

What does CVE-2026-112005 mean for file security?

This CVE describes a path traversal weakness (CWE-22). It means the application fails to restrict file system access properly, allowing an attacker to use built-in DuckDB functions to break out of intended directories. This grants them the ability to read or overwrite arbitrary files on the host system where the application is running.

How is this WhoDB vulnerability triggered?

The vulnerability is triggered by executing specific DuckDB filesystem functions within the WhoDB query editor. Crucially, the attacker does not need prior credentials to access this interface; simply reaching the query editor is sufficient to initiate unauthorized file operations. Standard database queries that do not invoke these specific filesystem functions will not trigger the bug.

Is my instance of WhoDB at risk according to Halo Surface Signal?

Halo Surface Signal indicates that because WhoDB is a web-based administrative console, it is frequently exposed to network access. If your WhoDB instance is reachable over the internet or an untrusted network, the risk is higher. You should assess whether your specific deployment is internet-facing or restricted to internal users.

How do I respond to this threat?

The first step is to inventory all WhoDB instances in your environment. Once identified, evaluate the network exposure and business criticality of each instance. Coordinate with the system owners to apply the latest security updates that resolve the path traversal flaw, ensuring that access to the query editor is properly secured or restricted.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.