Is CVE-2026-47253 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47253 being exploited in the wild.

How severe is CVE-2026-47253?

High severity, with a CVSS score of 7.3, published 14 September 2026.

Which products and versions are affected?

github.com/julien040/anyquery (Go) <= 0.4.4, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.4.5; Julien040 Anyquery <= 0.4.4.

Is there a fix for CVE-2026-47253?

Yes. github.com/julien040/anyquery (Go): upgrade to 0.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47253 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47253?

Check whether you run github.com/julien040/anyquery (Go) or Julien040 Anyquery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47253: julien040 Anyquery path traversal in clear_plugin_cache

Q: Is there a fix for CVE-2026-47253?

Yes. github.com/julien040/anyquery (Go): upgrade to 0.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47253 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-47253?

Check whether you run github.com/julien040/anyquery (Go) or Julien040 Anyquery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47253 · Severity: high · CVSS 7.3 · Published 2026-09-14

Anyquery, a tool for running SQL queries against various data sources, contains a vulnerability that allows an attacker to delete arbitrary folders on the server. By sending a specially crafted SQL command to the plugin cache management function, a user with basic access can bypass security restrictions and remove critical system or application directories. This can lead to permanent data loss and significant service disruptions.

Technologies: github.com/julien040/anyquery (Go), Julien040 Anyquery. Vendors: Go, Julien040.

Quick answers

Is CVE-2026-47253 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47253 being exploited in the wild.
How severe is CVE-2026-47253?: High severity, with a CVSS score of 7.3, published 14 September 2026.
Which products and versions are affected?: github.com/julien040/anyquery (Go) <= 0.4.4, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.4.5; Julien040 Anyquery <= 0.4.4.
Is there a fix for CVE-2026-47253?: Yes. github.com/julien040/anyquery (Go): upgrade to 0.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47253 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47253?: Check whether you run github.com/julien040/anyquery (Go) or Julien040 Anyquery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/julien040/anyquery (Go): upgrade to 0.4.5 or later
```
go get github.com/julien040/anyquery@v0.4.5
```

Technical details

A path traversal vulnerability exists in the `clear_plugin_cache` SQL scalar function within `namespace/other_functions.go`. The function takes a user-supplied `plugin` string and joins it with the cache directory path using `path.Join` without sufficient validation. Because `path.Join` resolves `..` segments, an attacker can provide a traversal string (e.g., `../../../../tmp/target`) to escape the intended directory. The resulting path is then passed to `os.RemoveAll`, allowing for the recursive deletion of any directory the server process has permissions to access. This can be triggered via the `/v1/query` or `/execute-query` HTTP endpoints by any user authorized to execute SQL queries.

Affected products

julien040 anyquery <= 0.4.4

Identifiers

CVE-2026-47253
GHSA-j9rx-rppg-6hh4
GO-2026-5459

Timeline

2026-06-09: advisory: Initial disclosure on GitHub Advisories
2026-06-10: patched: Fixed in version 0.4.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.