Clidey WhoDB: Path traversal in DuckDB query editor allows file read and write

Summary

WhoDB, a database management tool, contains a path traversal flaw in its DuckDB feature. In server mode with a DuckDB file, an unauthenticated remote attacker can use DuckDB file functions in the query editor to read and write arbitrary files on the host. This includes session.key and stored database credentials, and files can be overwritten, which can destroy data. Internet-facing instances are at the highest risk.

Affected

• WhoDB 0.104.0 up to but not including 0.135.0
• Only server-mode deployments with a DuckDB file source are affected
• Instances with only PostgreSQL, MySQL or similar sources are not affected by this bug

Fixed in

• WhoDB 0.135.0 or later (vendor advisory GHSA-x3h5-pr45-fx4r)

Workaround

• No vendor workaround is documented; upgrading is the fix
• Interim measures if you cannot patch now (our recommendation): take WhoDB off the internet, restrict access to trusted admin networks, and disable or remove DuckDB sources in server mode

Exploitation

• No reports of in-the-wild exploitation found
• The vendor advisory describes the attack in enough detail to build an exploit
• CISA SSVC in the CVE record: exploitation PoC, not automatable, total technical impact

Our recommendation

• Upgrade WhoDB to 0.135.0 or later, and verify the Docker image tag you deploy
• Check whether WhoDB is reachable from the internet and whether DuckDB sources are configured
• Apply the interim measures above if patching is not possible immediately
• Review logs for unexpected access to DuckDB sources
• Rotate database credentials stored in WhoDB connections if exposure is suspected

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-x3h5-pr45-fx4r github.com
• WhoDB release 0.135.0 github.com
• WhoDB fix commit 80111c9 github.com
• VulnCheck advisory www.vulncheck.com
• WhoDB db.go at 0.134.0 github.com
• WhoDB duckdb.go at 0.134.0 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:17.