CVE-2026-50006

Anyquery, an open-source SQL query engine built on SQLite, fails to restrict the ATTACH DATABASE statement in its MySQL-compatible server component prior to version 0.4.5. A remote, unauthenticated attacker who can reach the server's MySQL protocol port can send SQL that attaches a database at any filesystem path writable by the Anyquery server process, causing SQLite to create a file there and fill it with attacker-controlled table content. This enables arbitrary file creation or overwrite, leading to filesystem integrity loss and denial of service; remote code execution is possible only in cases where another service on the host interprets the written file or the server process holds write access to a privileged target. Anyone running anyquery server in MySQL-compatible mode at a version before 0.4.5 is affected, especially if the port is reachable from untrusted networks. The flaw is fixed in version 0.4.5; no public proof of concept is known and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

What to do: Upgrade anyquery server to version 0.4.5 or later immediately. If the MySQL-compatible port must be exposed, place it behind a firewall or VPN, require authentication where supported, and run the process as an unprivileged user with write access limited to a dedicated data directory. Review writable directories on affected hosts for unexpected SQLite database files or overwritten configuration files that could indicate prior abuse.