{"data":{"id":"edf52af1-39b9-4fdf-8398-c886f28f8499","title":"GHSA-j9rx-rppg-6hh4: Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion","summary":"The `clear_plugin_cache(plugin)` SQL scalar function in `namespace/other_functions.go` in julien040/anyquery 0.4.4 passes the caller-supplied `plugin` argument to `path.Join` and then to `os.RemoveAll`, guarded only by an empty-string check. Because `path.Join` resolves `..` segments, a low-privileged bearer-token holder can send `SELECT clear_plugin_cache('../../../../tmp/target')` to the `/v1/query` HTTP endpoint and delete directories outside the plugin cache that the server process can reach. The report states a directory outside `$XDG_CACHE_HOME/anyquery/plugins/` was successfully deleted in a verified scenario.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-j9rx-rppg-6hh4","publishedAt":"2026-06-10T17:11:53.000Z","cveId":"CVE-2026-47253","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/julien040/anyquery@<= 0.4.4 (fixed: 0.4.5)"],"affectedPackageNames":["github.com/julien040/anyquery"],"affectedPackageRefs":["go:github.com/julien040/anyquery"],"affectedVendors":[],"affectedVendorsRaw":["Anyquery"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00441,"epssCheckedAt":"2026-11-04T00:12:27.299Z","kevDateAdded":null,"advisoryAliases":["GHSA-j9rx-rppg-6hh4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-10T17:11:53.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:34:45.584Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/julien040/anyquery","fixedVersion":"0.4.5","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-10-29T21:34:45.437Z"}]}}