Anyquery is an SQL query engine built on SQLite. Versions before 0.4.5 forward unauthenticated SQL queries from the MySQL-compatible server port to SQLite without limiting the ATTACH DATABASE command's filesystem targets. This improper limitation (CWE-22) allows a remote attacker to select any writable path accessible by the anyquery server process, causing SQLite to create or overwrite database files with attacker-controlled content. This vulnerability leads to arbitrary file creation or overwrite, impacting filesystem integrity and availability. Remote code execution depends on external factors such as file interpretation by other services or privileged writable targets. The vulnerability is addressed in anyquery version 0.4.5.

The vulnerability allows remote attackers to create or overwrite arbitrary files on the server's filesystem where the anyquery process has write permissions. This can lead to loss of filesystem integrity and denial of service. While direct remote code execution is not guaranteed, it is possible if the attacker-controlled files are interpreted by other services or if the overwritten files have privileged write access. The CVSS score is 9.1 (critical), reflecting high impact on integrity and availability with network attack vector and no required privileges or user interaction.

Upgrade anyquery to version 0.4.5 or later, where this vulnerability is fixed by restricting ATTACH DATABASE filesystem targets. No other mitigations are specified or required once the official fix is applied.