Loading vulnerability…
CVE-2026-112005 is a remotely exploitable path traversal vulnerability in Clidey WhoDB versions 0.104.0 through versions before 0.135.0. Attackers can connect to a DuckDB file without credentials and invoke DuckDB filesystem operations through the query editor. Functions and statements including read_text, read_blob, COPY ... TO, and ATTACH permit arbitrary host file reads and writes, potentially exposing session-signing secrets and stored database credentials or allowing file overwrites.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A path traversal vulnerability in WhoDB versions starting at 0.104.0 and before 0.135.0 allows remote attackers to access a DuckDB file without credentials and invoke filesystem functions through the query editor. Attackers can read or overwrite arbitrary host files, including stealing session.key and stored database credentials.
A remotely exploitable path traversal vulnerability in Clidey WhoDB versions 0.104.0 through versions before 0.135.0. Attackers can access a DuckDB file without credentials and invoke read_text, read_blob, COPY ... TO, or ATTACH through the query editor to read or overwrite host files, including stealing session.key and stored database credentials. The content recommends upgrading to WhoDB 0.135.0 or later, restricting query-editor access, securing filesystem functions, and monitoring filesystem access logs.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.