CVE-2025-24786 is a critical path traversal flaw (CVSS 10.0) in WhoDB, an open source database management tool, that lets an unauthenticated user open any SQLite3 database on the host. It is fixed in WhoDB 0.45.0 and has no workaround. Upgrade now and do not expose WhoDB to untrusted networks.
What's affected
The NVD record names WhoDB from the clidey project, and the advisory says it is addressed in version 0.45.0 and that all users are advised to upgrade. Versions before 0.45.0 are the ones to treat as affected. There are no known workarounds.
The advisory explains the cause. WhoDB lets users connect to SQLite3 databases and only shows files in the directory /db by default, or ./tmp in development mode. The database file name is a value the user controls, and the code joins it to that default directory to build the full path. No check confirms that the final path still sits inside the default directory, so path traversal sequences in the name let a caller reach any SQLite3 database on the machine.
The record is not on the CISA Known Exploited Vulnerabilities list.
The weaknesses are classed as CWE-22 (path traversal) and CWE-35 (path traversal through a path with a leading directory step). The score is 10.0 (CRITICAL). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is high on confidentiality, high on integrity and no on availability. The record was published on 2025-02-06.
WhoDB 0.45.0 is the fixed release named in both the record and the advisory. Move to it or any later version. The advisory says no workaround is known, so patching is the only complete answer.
How to check if you're exposed
WhoDB usually runs as a container or a single binary, so start by finding where it runs.
- List running containers and look for WhoDB images.
docker ps --format "{{.Names}} {{.Image}}" | grep -i whodb
- Read the image tag or the binary's version and compare it with 0.45.0.
- Check who can reach the WhoDB port. If it is open beyond a trusted admin network, treat it as urgent.
- Make a list of SQLite3 files on the host that the WhoDB process can read. Anything an unauthenticated user could open is exposed in an affected version.
find / -name "*.sqlite*" -o -name "*.db" 2>/dev/null
- Look in access logs for requests that mention parent directory sequences in the database name.
What to do now
- Upgrade WhoDB to 0.45.0 or later on every host that runs it.
- If you cannot upgrade today, stop the service or block access to it from everything except a trusted admin address.
- Move WhoDB behind a VPN or an authenticating reverse proxy, since the tool itself had no login gate on this path.
- List the SQLite3 files reachable from the WhoDB process and treat their contents as potentially read if it was exposed.
- Rotate any secrets stored in those databases, such as tokens or API keys, if exposure is possible.
Why it matters
Path traversal, listed as CWE-22 and CWE-35, is a bug in how a file path is built. The program meant to restrict users to one folder, but it never checked where the joined path ended up, so a name that climbs upward escapes the folder. It is one of the most common web flaws and one of the simplest to fix: resolve the final path and check it sits inside the allowed directory.
The score of 10.0 comes from the combination. The vector shows network access, low complexity, no privileges, no interaction, and a changed scope with high confidentiality and integrity impact. Database admin tools are a high value target, because they are built to open data stores. Treat them as sensitive systems and never put one on a public address without a login in front.
If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which WhoDB version fixes CVE-2025-24786?
WhoDB 0.45.0, according to the record and the advisory. Move to it or later.
Is there a workaround if I cannot upgrade right away?
The advisory says there are no known workarounds. Stopping the service or cutting off network access until you can upgrade is the safest stopgap.
Sources
- Safeguard Gold entry for CVE-2025-24786
- NVD record data for CVE-2025-24786 (published 2025-02-06)
- WhoDB security advisory GHSA-9r4c-jwx3-3j76
Last reviewed: 19 October 2026.
