CVE-2026-54629: Anyquery Local File Read (LFR) Vulnerability
HIGHCVE-2026-54629 is a HIGH (CVSS 7.5) local file read (lfr) vulnerability (CWE-552: Files or Directories Accessible to External Parties) affecting Anyquery libraries in the Go ecosystem. The issue involves local file read (lfr) via unrestricted sqlite virtual table modules in server mode. Remediation is available in the latest vendor maintenance releases.
CVE-2026-54629 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2026-54629
To remediate this vulnerability, upgrade all affected Anyquery dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/julien040/anyquery to Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/julien040/anyqueryHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-54629, inspect your project dependencies for Anyquery:
inspect dependencies for github.com/julien040/anyqueryAnalyze the terminal output to locate any version of Anyquery in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-552: Files or Directories Accessible to External Parties, where the product makes files or directories accessible to unauthorized actors, even though they should not be. In Anyquery, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-54629 Affected Anyquery Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/julien040/anyquery
|
Go |
|
|
References
Frequently Asked Questions
What is CVE-2026-54629?
Which Anyquery versions are affected?
What version fixes CVE-2026-54629?
Is github.com/julien040/anyquery affected?
What is the CVSS score of CVE-2026-54629?
What CWE is associated with CVE-2026-54629?
How can I check Go dependencies for CVE-2026-54629?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-mf78-3rpf-r784",
"modified" : "2026-07-14T20:19:07Z",
"published" : "2026-07-14T20:19:07Z",
"aliases" : [ "CVE-2026-54629" ],
"summary" : "Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode",
"details" : "## Summary\nAnyquery's `server` mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., `csv_reader`, `log_reader`). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system (e.g., `/etc/passwd`, `~/.ssh/id_rsa`). This allows full Local File Read (LFR) capabilities, compromising sensitive system configurations and credentials.\n\n## Details\nAnyquery utilizes the `hashicorp/go-getter` library within its data ingestion modules. When Anyquery is launched in **Server Mode** (`anyquery server`), it binds to a TCP port and accepts MySQL protocol connections. The server handler does not restrict the usage of these virtual table modules to safe directories. An attacker can connect to the server and execute native SQLite virtual table creation queries to instantiate modules like `csv_reader` pointing to restricted files. Because the file read operation is initiated by the Anyquery server process, the attacker can read any file the process has access to.\n\n## PoC (Proof of Concept)\n1. Start the server on the victim machine:\n ```bash\n anyquery server --host 0.0.0.0 --port 8070\n ```\n2. Connect from an attacker machine:\n ```bash\n mysql -u root -h <VICTIM_IP> -P 8070\n ```\n3. Execute the following payload to read `/etc/passwd`:\n ```sql\n CREATE VIRTUAL TABLE passwd USING csv_reader('/etc/passwd');\n SELECT * FROM passwd;\n ```\n\n## Impact\n- **Confidentiality:** High. Complete compromise of local file system confidentiality.\n- **Integrity:** None.\n- **Availability:** None.\n- **CVSS Score:** 7.5 (High) - `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`\n\n## Remediation\nImplement a sandboxing mechanism in Server Mode (e.g., a `--restrict-paths` flag) to limit `read_*` operations to designated directories.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/julien040/anyquery"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "< 0.4.5"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/julien040/anyquery/security/advisories/GHSA-mf78-3rpf-r784"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/julien040/anyquery"
}, {
"type" : "WEB",
"url" : "https://github.com/julien040/anyquery/releases/tag/0.4.5"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22", "CWE-284", "CWE-552", "CWE-73", "CWE-862" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-14T20:19:07Z",
"nvd_published_at" : null
}
}