CVE-2026-47253: Anyquery Path Traversal Vulnerability

CVE-2026-47253 Overview

Anyquery is an SQL query engine built on top of SQLite. Versions prior to 0.4.5 contain a path traversal vulnerability [CWE-22] in the clear_plugin_cache(plugin) SQL scalar function defined in namespace/other_functions.go. The function passes a caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token holder can invoke this function through the /v1/query HTTP endpoint to delete arbitrary directories writable by the Anyquery server process. The issue is fixed in version 0.4.5.

Critical Impact
Authenticated attackers can recursively delete any directory reachable by the Anyquery server process, causing permanent data loss and denial of service.

Affected Products

Anyquery versions prior to 0.4.5
Anyquery server instances exposing the /v1/query HTTP endpoint
Deployments where the server process holds write access to sensitive directories

Discovery Timeline

2026-09-14 - CVE CVE-2026-47253 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-47253

Vulnerability Analysis

The clear_plugin_cache(plugin) SQL scalar function accepts a plugin name from the caller and joins it to the plugin cache base directory using Go's path.Join. The resulting path is passed directly to os.RemoveAll, which recursively deletes the target. Because path.Join normalizes but does not reject .. traversal segments, an attacker-supplied value such as ../../../etc resolves outside $XDG_CACHE_HOME/anyquery/plugins/.

Exploitation requires only a valid bearer token, which is a low-privilege authentication tier in Anyquery deployments. The attacker submits the crafted query through the /v1/query HTTP endpoint. The confidentiality impact is none, but integrity and availability impacts are high because destroyed data cannot be recovered by the server. User interaction is required, per the CVSS vector, likely reflecting the token issuance workflow.

Root Cause

The root cause is missing input validation on the plugin parameter. The code assumes the value is a bare plugin identifier, but path.Join collapses .. segments during normalization rather than rejecting them. This produces a resolved path that escapes the intended plugin cache directory before os.RemoveAll executes.

Attack Vector

An authenticated bearer-token holder issues an SQL query invoking clear_plugin_cache with a traversal payload through the network-exposed /v1/query endpoint. The Anyquery server process then recursively removes the resolved directory. Any filesystem location writable by the server user, including database files, configuration directories, or mounted volumes, becomes a valid target.

// Patch excerpt from cmd/helper.go adding sandbox flags to remediate
// CVE-2026-47253 and CVE-2026-50006
func addSandboxFlags(cmd *cobra.Command, isServer bool) {
	cmd.Flags().StringSlice("allow-dirs", []string{}, "When sandboxed, directories that read_* tables (and on-disk ATTACH) may access (repeatable, comma-separated)")
	cmd.Flags().Bool("allow-remote", false, "When sandboxed, allow read_* tables to fetch remote URLs (http/https/s3/...)")
	cmd.Flags().Bool("allow-attach", false, "When sandboxed, allow ATTACH/VACUUM INTO to on-disk paths within --allow-dirs")
	cmd.Flags().Bool("allow-db-connections", false, "When sandboxed, allow the database reader modules (duckdb/postgres/mysql/clickhouse/cassandra)")
	if isServer {
		cmd.Flags().Bool("no-sandbox", false, "Disable server sandboxing entirely (UNSAFE: exposes local file read, SSRF, and arbitrary file write)")
	} else {
		cmd.Flags().Bool("sandbox", false, "Apply server-style sandboxing restrictions (off by default in CLI mode)")
	}
}

Source: GitHub Commit 27f84fc

Detection Methods for CVE-2026-47253

Indicators of Compromise

HTTP POST requests to /v1/query containing the string clear_plugin_cache combined with .. path segments or absolute path prefixes.
Unexpected deletion of directories owned by the user account running the Anyquery server process.
Application or system logs showing os.RemoveAll operations outside $XDG_CACHE_HOME/anyquery/plugins/.

Detection Strategies

Inspect Anyquery access logs for SQL payloads invoking clear_plugin_cache with non-alphanumeric plugin identifiers.
Correlate bearer-token authenticated sessions with filesystem change events on the host running Anyquery.
Alert on sudden mass-deletion events in directories adjacent to the Anyquery working tree.

Monitoring Recommendations

Enable filesystem auditing (auditd, FIM, or equivalent) on the Anyquery server user's writable paths.
Forward Anyquery HTTP request logs to a centralized log platform and retain query bodies for post-incident review.
Track process-level file deletion syscalls originating from the Anyquery binary.

How to Mitigate CVE-2026-47253

Immediate Actions Required

Upgrade Anyquery to version 0.4.5 or later without delay.
Rotate all bearer tokens issued for the Anyquery HTTP API after upgrading.
Restrict network access to the /v1/query endpoint to trusted clients only.

Patch Information

The fix is delivered in Anyquery release 0.4.5. The remediation, tracked in commit 27f84fc, introduces server-side sandboxing enabled by default, with --no-sandbox, --allow-dirs, --allow-remote, --allow-attach, and --allow-db-connections flags governing relaxations. Full technical detail is documented in GHSA-j9rx-rppg-6hh4.

Workarounds

Run the Anyquery server as an unprivileged user with write access limited to the plugin cache directory only.
Deploy the server inside a container or chroot with a minimal writable filesystem view.
Place a reverse proxy in front of /v1/query that rejects SQL bodies containing clear_plugin_cache.

bash

# After upgrading to 0.4.5, run the server with strict sandbox settings
anyquery server \
  --allow-dirs "/var/lib/anyquery/data" \
  # Omit --no-sandbox to keep server sandboxing enabled by default
  # Omit --allow-remote and --allow-attach unless explicitly required