Anyquery is an SQL query engine built on SQLite. Before version 0.4.5, the clear_plugin_cache(plugin) function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without sanitizing traversal segments (e.g., '..'). This allows a low-privileged bearer-token holder to invoke the function via the /v1/query HTTP endpoint and cause path.Join to resolve paths outside the intended $XDG_CACHE_HOME/anyquery/plugins/ directory. Consequently, os.RemoveAll recursively deletes any directory writable by the Anyquery server process, leading to permanent data loss and denial of service. The vulnerability is addressed in version 0.4.5.

Exploitation allows a low-privileged authenticated user to delete arbitrary directories writable by the Anyquery server process, resulting in permanent data loss and denial of service. There is no confidentiality impact as file contents are not disclosed.

Upgrade to anyquery version 0.4.5 or later, where this path traversal vulnerability is fixed. No other mitigation is indicated by the vendor advisory.