CVE-2026-112005

LOWCVSS 9.2 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://nvd.nist.gov/vuln/detail/CVE-2026-11

Full discourse1 post

ADK Cyber@ADKCyber1d
CVE-2026-112005 (CVSS 9.2): WhoDB 0.104.0–0.135.0 has path traversal allowing arbitrary file access via query editor. Update immediately if in use. https://nvd.nist.gov/vuln/detail/CVE-2026-11… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/jmqqboxGp1
0000030
99 followersView on X

Explore more

Back to dashboard