CVE-2026-112005 is a high severity (CVSS 7.7 in the record) path traversal in WhoDB 0.104.0 before 0.135.0. DuckDB sessions can read and write host files without credentials. Upgrade to 0.135.0. The sections below cover affected versions, how to check, and what to do first.
What's affected
WhoDB 0.104.0 before 0.135.0, per the record, VulnCheck and the GitHub advisory, which lists 0.135.0 as patched. The 0.135.0 release notes mention a security fix for a DuckDB bypass.
Severity differs by source. The record scores it 7.7 High under CVSS 3.1. VulnCheck labels it Critical with a CVSS 4.0 score of 9.2. The title follows the record, but you should treat it as urgent.
The advisory says that in server mode WhoDB confines file based sources to one directory, and that for DuckDB only the open check exists.
Scoring note: the record's 7.7 is a CVSS 3.1 base score. VulnCheck's advisory also lists 9.2 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Check which WhoDB version or image tag you run and compare it with 0.135.0. Check whether any instance is reachable from outside your trusted network.
The advisory says no account is needed to open a DuckDB session on a file in the allowed directory. So treat any reachable instance as exposed.
What to do now
- Find every WhoDB instance and version.
- Upgrade to 0.135.0 or later.
- Take instances off public networks until they are upgraded.
- Rotate database credentials that WhoDB stored or used, because the advisory says session credentials can be read.
- Review file changes on the host for unexpected files in directories the process can write.
- Run the process as an unprivileged user with a narrow file system view.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Prioritise by what is reachable, not by the score alone. Reachability analysis asks whether your own code actually calls the vulnerable path and whether an attacker can get to it. A flaw in a component you never expose is less urgent than the same flaw on a public host, so use that view to order your work.
Why it matters
This is CWE-22, improper limitation of a pathname to a restricted directory. WhoDB limits file sources to one directory and enforces that twice for SQLite. For DuckDB it checked only when the file was opened. Once the session exists, SQL run in the query editor can use DuckDB's own file functions on any path the process can access.
The advisory says this can disclose every signed in user's stored database credentials. A query tool needs the same containment inside the session as at the door. It is not listed in CISA KEV.
Quick check
Which score is right?
The record says 7.7 High and VulnCheck says 9.2 Critical under a newer scoring system. Either way, upgrade.
Is a login required?
The advisory says no account is needed.
Sources
Last reviewed: 18 October 2026.
