Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/julien040/anyquery

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.3GoPublished

    Anyquery has Path Traversal through clear_plugin_cache, Allowing Arbitrary Directory Deletion

    CVE-2026-47253 · GHSA-j9rx-rppg-6hh4

    Affected
    • Go github.com/julien040/anyquery <= 0.4.4
    Fixed in
    0.4.5· Vendor fix available
    Issue
    Path Traversal in clearplugincache Allows Arbitrary Directory Deletion | Field | Value | | ---------------- | ----- | | Repository | julien040/anyquery | | Affected version | 0.4.4 | | Vulnerability | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory | | Severity | High | Summary The SQL scalar function clearplugincache(plugin) in namespace/otherfunctions.go passes the caller-supplied plugin argument directly to path.Join and then to os.RemoveAll, with only an empty-string check as a guard. Because path.Join silently resolves .. segments, a low-privileged bearer-token holder can submit SELECT clearplugincache('../../../../tmp/target') to the /v1/query HTTP endpoint and delete any directory reachable by the server process. In the verified scenario, a directory outside $XDGCACHEHOME/anyquery/plugins/ was successfully deleted, confirming full path-traversal exploitation. Affected Code namespace/otherfunctions.go:46 — pathlib.Join resolves .. segments in…

    Recommended action: Upgrade to 0.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →