Executive brief
Anyquery, a tool for running SQL queries against various data sources, contains a vulnerability that allows an attacker to delete arbitrary folders on the server. By sending a specially crafted SQL command to the plugin cache management function, a user with basic access can bypass security restrictions and remove critical system or application directories. This can lead to permanent data loss and significant service disruptions.
Technical details
A path traversal vulnerability exists in the `clear_plugin_cache` SQL scalar function within `namespace/other_functions.go`. The function takes a user-supplied `plugin` string and joins it with the cache directory path using `path.Join` without sufficient validation. Because `path.Join` resolves `..` segments, an attacker can provide a traversal string (e.g., `../../../../tmp/target`) to escape the intended directory. The resulting path is then passed to `os.RemoveAll`, allowing for the recursive deletion of any directory the server process has permissions to access. This can be triggered via the `/v1/query` or `/execute-query` HTTP endpoints by any user authorized to execute SQL queries.
Affected products
- julien040 anyquery <= 0.4.4
Timeline
- 2026-06-09: advisory: Initial disclosure on GitHub Advisories
- 2026-06-10: patched: Fixed in version 0.4.5