CVE-2026-50006: Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatib

Executive brief

Anyquery is a tool that allows users to run SQL queries on various data sources. When running in server mode, it fails to restrict certain database commands, allowing an unauthenticated attacker to write files anywhere on the system where the application has permission. This can lead to a complete system takeover if an attacker overwrites critical system files or web server scripts.

Technical details

Anyquery in 'server' mode (MySQL-compatible) blindly proxies SQL commands to an underlying SQLite engine without restricting administrative commands. An unauthenticated remote attacker can use the 'ATTACH DATABASE' command to create or overwrite files at arbitrary paths on the host filesystem. By injecting malicious payloads into these files (such as cron jobs or PHP shells), an attacker can achieve Remote Code Execution (RCE). The vulnerability is rooted in missing authorization and unrestricted access to dangerous SQLite functions. Users should update to version 0.4.5 or later where these functions are restricted in server mode.

Affected products

• julien040 anyquery < 0.4.5

Timeline

• 2026-06-09: disclosed: Vulnerability reported to vendor
• 2026-07-14: advisory: GitHub Advisory published
• 2026-07-14: patched: Fixed in version 0.4.5

References

• https://api.github.com/users/Metincloup
• https://github.com/Metincloup
• https://api.github.com/users/Metincloup/gists%7B/gist_id%7D
• https://api.github.com/users/Metincloup/repos
• https://avatars.githubusercontent.com/u/88655361?v=4
• https://api.github.com/users/Metincloup/events%7B/privacy%7D