CVE-2026-54629 describes a path traversal vulnerability (CWE-22) in julien040's Anyquery SQL query engine before version 0.4.5. The Anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without requiring authentication, authorization, or enforcing directory restrictions. An attacker can exploit this by issuing SQLite CREATE VIRTUAL TABLE statements that specify local file paths. These modules use hashicorp/go-getter under the server process, allowing the attacker to read arbitrary files accessible by the server process and return their contents as queryable table rows. This can lead to disclosure of sensitive system configuration, credentials, and private keys. The issue is resolved in Anyquery version 0.4.5.

An unauthenticated remote attacker can read arbitrary files on the server filesystem with the privileges of the Anyquery server process. This can lead to disclosure of sensitive information such as system configuration files, credentials, and private keys. There is no impact on integrity or availability reported.

Upgrade Anyquery to version 0.4.5 or later, where this vulnerability is fixed. Prior versions expose this risk due to lack of authentication and directory restrictions on file-backed SQLite virtual table modules. No other mitigation is indicated.