CVE-2025-24786

Summary

CVE-2025-24786 is a vulnerability affecting WhoDB, an open-source database management tool. The issue lies in the lack of path traversal prevention, enabling unauthenticated attackers to open any Sqlite3 database present on the host machine. Despite the application only displaying databases in the default directory "/db", an attacker can exploit this weakness by manipulating the user-controlled database file value and using it to open databases located outside of this directory. This vulnerability, which has no known workarounds, has been addressed in WhoDB version 0.45.0. All users are advised to upgrade as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.