WhoDB CVE-2026-112005

Applies to WhoDB server (non-local) mode where the DuckDB plugin is reachable: the attacker opens a DuckDB file connection through the query editor without credentials and runs read_text, read_blob, COPY ... TO, or ATTACH to read or overwrite arbitrary host files, because versions 0.104.0 through 0.134.0 opened the DuckDB DSN without enable_external_access=false or lock_configuration=true. The limiting factor captured by CVSS AT:P is that the attacker must be able to reach and initiate the DuckDB query path; exploitation is bounded to the affected version range (fixed in 0.135.0) and to deployments exposing the query editor over the network. File access is further bounded by the privileges of the WhoDB process on the host.

Multiple signals converge on genuine priority. The vendor-assigned CVSS 4.0 score is 9.2 (Critical) with AV:N/AC:L/PR:N/UI:N, indicating remote, unauthenticated, low-complexity access, and VC:H/VI:H confirming both arbitrary file read and write of sensitive host data. The one mitigating metric is AT:P (attack requirement present), reflecting that the attacker must reach and open a DuckDB connection through the query editor rather than hitting a universally-exposed endpoint. No EPSS score, SSVC decision data, KEV listing, or public POC was provided in the input, so exploitation-probability and in-the-wild signals cannot be quantified - this is a data gap, not evidence of low risk. The flaw was reported by VulnCheck (a credible research source) and a vendor patch plus security advisory (GHSA-x3h5-pr45-fx4r) exist, which both validates the finding and typically shortens the window before exploit code appears. Net assessment: a real, high-priority issue for any internet- or network-reachable WhoDB server-mode deployment, tempered only by the product's limited deployment footprint and the requirement that the DuckDB query path be reachable.

An attacker who can reach a network-exposed WhoDB instance in server mode opens the query editor and connects to a DuckDB file without supplying credentials. They then issue DuckDB filesystem functions such as read_text, read_blob, or COPY ... TO to read the application's session.key and stored database credentials, or to overwrite arbitrary files the WhoDB process can access. No public exploit was identified at time of analysis, but the low attack complexity and unauthenticated network vector make reliable exploitation straightforward once the query path is reached.