# CVE-2026-47253: julien040 Anyquery path traversal in clear_plugin_cache

Source: https://junglewise.ai/threats/cve-2026-47253-julien040-anyquery-path-traversal-in-clear-plugin-cache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-47253 · Severity: high · CVSS 7.3 · Published 2026-09-14

Anyquery, a tool for running SQL queries against various data sources, contains a vulnerability that allows an attacker to delete arbitrary folders on the server. By sending a specially crafted SQL command to the plugin cache management function, a user with basic access can bypass security restrictions and remove critical system or application directories. This can lead to permanent data loss and significant service disruptions.

Technologies: [github.com/julien040/anyquery (Go)](https://junglewise.ai/threats/technologies/github-com-julien040-anyquery), [Julien040 Anyquery](https://junglewise.ai/threats/technologies/anyquery). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Julien040](https://junglewise.ai/threats/vendors/julien040).

## Quick answers

**Is CVE-2026-47253 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47253 being exploited in the wild.

**How severe is CVE-2026-47253?** High severity, with a CVSS score of 7.3, published 14 September 2026.

**Which products and versions are affected?** github.com/julien040/anyquery (Go) <= 0.4.4, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.4.5; Julien040 Anyquery <= 0.4.4.

**Is there a fix for CVE-2026-47253?** Yes. github.com/julien040/anyquery (Go): upgrade to 0.4.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47253 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47253?** Check whether you run github.com/julien040/anyquery (Go) or Julien040 Anyquery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/julien040/anyquery (Go): upgrade to 0.4.5 or later

  ```sh
  go get github.com/julien040/anyquery@v0.4.5
  ```


## Technical details

A path traversal vulnerability exists in the `clear_plugin_cache` SQL scalar function within `namespace/other_functions.go`. The function takes a user-supplied `plugin` string and joins it with the cache directory path using `path.Join` without sufficient validation. Because `path.Join` resolves `..` segments, an attacker can provide a traversal string (e.g., `../../../../tmp/target`) to escape the intended directory. The resulting path is then passed to `os.RemoveAll`, allowing for the recursive deletion of any directory the server process has permissions to access. This can be triggered via the `/v1/query` or `/execute-query` HTTP endpoints by any user authorized to execute SQL queries.

## Affected products

- julien040 anyquery <= 0.4.4

## Identifiers

- CVE-2026-47253
- GHSA-j9rx-rppg-6hh4
- GO-2026-5459

## Timeline

- 2026-06-09: advisory: Initial disclosure on GitHub Advisories
- 2026-06-10: patched: Fixed in version 0.4.5

## References

- [https://api.github.com/users/232-323](https://api.github.com/users/232-323)
- [https://github.com/232-323](https://github.com/232-323)
- [https://api.github.com/users/232-323/gists%7B/gist_id%7D](https://api.github.com/users/232-323/gists%7B/gist_id%7D)
- [https://api.github.com/users/232-323/repos](https://api.github.com/users/232-323/repos)
- [https://avatars.githubusercontent.com/u/196280629?v=4](https://avatars.githubusercontent.com/u/196280629?v=4)
- [https://api.github.com/users/232-323/events%7B/privacy%7D](https://api.github.com/users/232-323/events%7B/privacy%7D)

## Related threats

- [Anyquery local file read via unrestricted SQLite virtual tables](https://junglewise.ai/threats/cve-2026-54629-anyquery-local-file-read-via-unrestricted-sqlite-virtual-tables)
- [Anyquery SSRF via Unrestricted SQLite Virtual Table Modules in Server Mode](https://junglewise.ai/threats/cve-2026-54628-anyquery-ssrf-via-unrestricted-sqlite-virtual-table-modules-in)
- [Anyquery arbitrary file write via ATTACH DATABASE in server mode](https://junglewise.ai/threats/cve-2026-50006-anyquery-arbitrary-file-write-via-attach-database-in-server-mode)