CVE-2026-47253

🗓️ 14 Sep 2026 19:54:24Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 58 Views🌐 WEB

Path traversal in Anyquery clear_plugin_cache allows arbitrary directory deletion via path.Join.

Reporter	Title	Published	Views	Family All 18
BDU FSTEC	Vulnerability of the clear_plugin_cache() function in the SQL database of Anyquery, allowing a hacker to cause a service failure	17 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-47253	9 Jun 202621:19	–	circl
Cvelist	CVE-2026-47253 Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion	14 Sep 202619:54	–	cvelist
EUVD	EUVD-2026-77807	14 Sep 202619:54	–	euvd
Github Security Blog	Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion	10 Jun 202617:11	–	github
Mend	CVE-2026-47253	14 Sep 202619:54	–	mend
NVD	CVE-2026-47253	14 Sep 202620:16	–	nvd
OSV	GHSA-J9RX-RPPG-6HH4 Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion	10 Jun 202617:11	–	osv
OSV	GO-2026-5459 Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion in github.com/julien040/anyquery	25 Jun 202622:34	–	osv
OSV	OPENSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb	30 Jul 202609:09	–	osv

Vulners

Node

julien040 anyqueryRange<0.4.5

[
  {
    "vendor": "julien040",
    "product": "anyquery",
    "versions": [
      {
        "version": "< 0.4.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/julien040/anyquery/releases/tag/0.4.5
github	www.github.com/julien040/anyquery/security/advisories/GHSA-j9rx-rppg-6hh4
github	www.github.com/julien040/anyquery/commit/27f84fc168310455eaf81ec4ba87eed20298670c

Parameter	Position	Path	Description	CWE
plugin	request body	/v1/query	Exploits clear_plugin_cache(plugin) invoked via /v1/query by passing a caller-controlled plugin parameter; path.Join is used on the parameter and then os.RemoveAll deletes directories, enabling path traversal, data loss and DoS.	CWE-22

30 Sep 2026 19:08Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.3

EPSS0.00441

SSVC

CWE-22