CVE-2026-47253

Executive Summary

CVE-2026-47253 is a path traversal vulnerability (CWE-22) in Anyquery, an SQL query engine built on SQLite, affecting versions prior to 0.4.5. The clear_plugin_cache(plugin) SQL scalar function passes a caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments, allowing a low-privileged bearer-token holder to recursively delete arbitrary directories writable by the Anyquery server process via the /v1/query HTTP endpoint. The impact is high-integrity and high-availability loss (permanent data loss and denial of service) with no confidentiality impact, yielding a CVSS v3.1 base score of 7.3.

Technical Analysis

Anyquery exposes an SQL surface, including a scalar function clear_plugin_cache(plugin), defined in namespace/other_functions.go. This function is intended to clear cached plugin data beneath the application cache root, resolved as $XDG_CACHE_HOME/anyquery/plugins/. According to the NVD description, the plugin argument is caller-controlled and is joined to a base path using Go's path.Join before being handed to os.RemoveAll. path.Join performs lexical path normalization: it collapses . and .. segments. Consequently, supplying .. sequences causes the resolved path to escape the intended $XDG_CACHE_HOME/anyquery/plugins/ directory. Because the code does not reject traversal segments and does not validate that the final resolved path remains inside the allow-listed cache root, os.RemoveAll will recursively delete any directory reachable and writable by the process identity running the Anyquery server.

The attack surface is the HTTP query interface. The /v1/query endpoint accepts SQL statements authenticated via a bearer token; the vulnerability requires only a low-privileged bearer-token holder, not administrative privileges. The vulnerable operation is destructive-only: os.RemoveAll removes files and directories but does not return file contents, which aligns with the CVSS vector showing Confidentiality:None and Integrity:High / Availability:High.

Two implementation weaknesses combine to enable exploitation:

1. Missing canonicalization check — the resolved absolute path is not verified against the intended cache root prefix after path.Join (e.g., no filepath.Clean plus strings.HasPrefix containment test).
2. Missing traversal input validation — the plugin parameter does not reject .. segments or absolute path components.

The fix in 0.4.5 implies these controls were added. Patch confidence is 2/4 (CLAIMED): only a single source (OSV) indicates a patch, and it has not been independently confirmed via a vendor advisory in the supplied data. No public proof-of-concept, Nuclei template, or exploit code is known, and the EPSS score of 0.00441 (35.9th percentile) indicates low predicted exploitation activity at present.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (path traversal to arbitrary recursive deletion) and the specifics stated verbatim in the NVD description.

1. Reconnaissance / target identification. An attacker identifies an exposed Anyquery instance whose /v1/query HTTP endpoint is reachable. The attacker must already possess a valid bearer token (low privilege is sufficient). No special UI interaction beyond submitting the request is required, though the CVSS vector includes UI:R, indicating some user-driven request submission is modeled in the score.

2. Triggering the flaw class. The attacker issues an SQL statement through /v1/query that invokes the clear_plugin_cache(plugin) scalar function, supplying a plugin value containing .. traversal segments designed to climb out of $XDG_CACHE_HOME/anyquery/plugins/. The supplied value also determines the target subtree the attacker wishes to delete.

3. Execution at the vulnerability-class level. The function passes the attacker-controlled plugin value through path.Join, which normalizes the .. segments and yields a path outside the intended cache root. That resolved path is passed to os.RemoveAll, which recursively deletes the directory and its contents. No specific payload string is published; the mechanism is generic traversal-segment injection into a path that is later joined and deleted.

4. Post-exploitation impact. Successful invocation causes permanent deletion of any reachable directory writable by the Anyquery server process — resulting in data loss and denial of service. Because os.RemoveAll does not disclose file contents, there is no direct data exfiltration in this CVE; the outcome is destructive integrity and availability impact only.

Impact Assessment

The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H produces a base score of 7.3 (High). Breaking this down:

• Attack Vector (N): exploitable over the network via the HTTP /v1/query endpoint.
• Attack Complexity (L): no special conditions beyond a valid low-privileged token and knowledge of the traversal technique.
• Privileges Required (L): a low-privileged bearer-token holder suffices; no admin rights needed.
• User Interaction (R): the vector models a user-driven action (request submission).
• Scope (U): impact is confined to the security authority of the Anyquery process.
• Confidentiality (N): no file contents are disclosed.
• Integrity (H) / Availability (H): recursive deletion of arbitrary reachable, writable directories yields severe integrity and availability loss.

Blast radius: any directory writable by the Anyquery server process is in scope, not just the plugin cache. On hosts where the server process has broad write permissions (e.g., running as a shared service account), the effect could extend well beyond Anyquery's own data directory, causing permanent, non-recoverable data loss absent backups. The primary business impacts are service outage, loss of cached or persistent data, and potential collateral deletion of unrelated application data co-located under writable paths on the same host. There is no lateral movement or credential theft implied by this CVE given the absence of a confidentiality impact.

Detection Guidance

Sigma Rule

title: Anyquery clear_plugin_cache Path Traversal Deletion Attempt (CVE-2026-47253)
id: 8f3c1a2e-4b6d-4e2f-9a71-anyquery0001
status: experimental
description: Detects HTTP requests to the Anyquery /v1/query endpoint invoking clear_plugin_cache with path traversal segments, indicating attempted arbitrary directory deletion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-47253
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/v1/query'
  selection_function:
    cs-uri-query|contains|all:
      - 'clear_plugin_cache'
  selection_traversal:
    cs-uri-query|contains:
      - '..'
      - '%2e%2e'
      - '..%2f'
      - '%2e%2e%2f'
  condition: selection_endpoint and selection_function and selection_traversal
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrative requests without traversal segments (unlikely)
level: high
tags:
  - attack.t1485
  - cve.2026.47253

YARA Rule

rule CVE_2026_47253_Anyquery_ClearPluginCache_Traversal
{
    meta:
        description = "Detects exploitation attempts of Anyquery clear_plugin_cache path traversal (CVE-2026-47253) in HTTP request logs or captured payloads"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-47253"
        date = "2026-01-01"
        severity = "high"

    strings:
        $fn   = "clear_plugin_cache" ascii nocase
        $ep   = "/v1/query" ascii nocase
        $trav1 = ".." ascii
        $trav2 = "%2e%2e" ascii nocase
        $trav3 = "..%2f" ascii nocase

    condition:
        $fn and ($trav1 or $trav2 or $trav3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-47253 Anyquery clear_plugin_cache Path Traversal Deletion Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/v1/query"; http.request_body; content:"clear_plugin_cache"; http.request_body; content:".."; reference:cve,2026-47253; classtype:attempted-dos; sid:202647253; rev:1;)

Elastic Detection

any where event.category == "web" and
  url.path == "/v1/query" and
  stringContains(url.query, "clear_plugin_cache") and
  (stringContains(url.query, "..") or stringContains(url.query, "%2e%2e") or stringContains(url.query, "..%2f"))

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=coalesce(uri_path, cs_uri_stem), query=coalesce(uri_query, cs_uri_query)
| where like(uri, "%/v1/query%") AND (like(query, "%clear_plugin_cache%"))
| where (like(query, "%..%") OR like(query, "%2e%2e%") OR like(query, "%..%2f%"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, query
| sort - count

Wazuh OSSEC Rule

<group name="web,anyquery,cve-2026-47253,">
  <rule id="202647253" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/v1/query</field>
    <regex field="url">clear_plugin_cache</regex>
    <regex field="url">(\.\.|%2e%2e|\.\.%2f)</regex>
    <description>CVE-2026-47253: Anyquery clear_plugin_cache path traversal deletion attempt detected</description>
    <mitre>
      <id>T1485</id>
    </mitre>
    <group>cve_2026_47253,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations

   • Restrict network access to the Anyquery /v1/query endpoint (bind to localhost/loopback, or place behind an authenticated reverse proxy with strict ACLs) until patching is complete.
   • Rotate and tightly scope all bearer tokens; revoke tokens not strictly required. Note: low-privileged tokens are sufficient to exploit, so privilege reduction alone is insufficient — token count and network reachability must both be minimized.
   • Run the Anyquery server under a dedicated, least-privilege service account with write access limited to only the cache directory ($XDG_CACHE_HOME/anyquery/plugins/) and no other writable paths, to constrain the destructive blast radius of os.RemoveAll.
   • Ensure robust, offline, versioned backups of any data on the same host that may reside under directories writable by the Anyquery process.
   • If the endpoint is not required, disable or block the HTTP query interface entirely.

2. Patch / upgrade steps

   • Upgrade Anyquery to version 0.4.5 or later, which the source states fixes the issue.
   • Because the patch is only claimed by a single source and not independently confirmed, verify the fix by reviewing the vendor's release notes/changelog and, if feasible, by confirming (in a non-production test) that traversal segments no longer escape the cache root. Do not assume the fix without verification.
   • After upgrading, restart the Anyquery service and re-verify that the /v1/query endpoint behaves as expected.

3. Long-term hardening

   • Enforce path canonicalization and containment checks: after resolving a user-supplied path, verify it lies within the intended allow-listed base directory before any destructive file operation.
   • Reject input containing .. traversal segments and absolute path components at function boundaries.
   • Apply the principle of least privilege to the service account and its writable directories.
   • Monitor for anomalous invocations of destructive SQL functions via the detection rules above.
   • Establish a patch-management process with independent verification of vendor fixes, given the single-source patch claim here.

References

• NVD — CVE-2026-47253: https://nvd.nist.gov/vuln/detail/CVE-2026-47253
• OSV Advisory (patch source, version 0.4.5): https://osv.dev/ (search CVE-2026-47253)
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1485 — Data Destruction: https://attack.mitre.org/techniques/T1485/
• FIRST EPSS — CVE-2026-47253 score and percentile: https://api.first.org/data/v1/epss?cve=CVE-2026-47253

Exploit-in-the-wild / threat actor activity: No public proof-of-concept, Nuclei template, or exploit code is known for CVE-2026-47253, and the EPSS score (0.00441 / 35.9th percentile) indicates low predicted exploitation. CVE-2026-47253 is not listed in CISA KEV; no threat actor campaigns or in-the-wild exploitation evidence are associated with this CVE in the provided data.