Anyquery's "server" mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., "csv_reader", "log_reader"). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system (e.g., "/etc/passwd", "~/.ssh/id_rsa"). This allows full Local File Read (LFR) capabilities, compromising sensitive system configurations and credentials.