A path traversal issue exists that allows remote attackers to read and write arbitrary host files. This is achieved by executing DuckDB filesystem functions through the query editor. An attacker can access a DuckDB file without credentials and utilize functions such as `read text()`, `read blob()`, `COPY ... TO`, or `ATTACH` to steal `session.key` and stored database credentials or overwrite files.