CVE-2026-50006

Name of the Vulnerable Software and Affected Versions Anyquery (affected versions not specified)

Description When running in server mode, the software fails to restrict native SQLite disk manipulation commands. Unauthenticated attackers connecting to the MySQL-compatible server port can use the ATTACH DATABASE command to write arbitrary SQLite databases to any path on the filesystem where the process has write permissions. This leads to Arbitrary File Write (AFW), which can result in Remote Code Execution (RCE) if the attacker can overwrite system cronjobs or drop a web shell in a directory served by a web server.

Recommendations Disable dangerous SQLite functions such as ATTACH DATABASE and DETACH DATABASE when running in server mode. Restrict the MySQL handler to permit operations only on the main database or in-memory virtual tables.