CVE-2026-47253

Name of the Vulnerable Software and Affected Versions anyquery versions prior to 0.4.5

Description A path traversal issue exists in the SQL scalar function clear plugin cache() within the namespace/other functions.go file. The function accepts a plugin argument and passes it to path.Join and os.RemoveAll without sufficient validation. Because path.Join resolves .. segments, an authenticated user with a low-privileged bearer token can provide a specially crafted path to the /v1/query or /execute-query HTTP endpoints to delete any directory accessible by the server process. This can lead to irreversible data loss and denial of service by targeting configuration directories or application data outside the intended cache root.

Recommendations Update anyquery to version 0.4.5 or later. As a temporary mitigation, restrict access to the clear plugin cache() function or avoid passing user-controlled input to the plugin variable.