Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language (VQL) queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEM_READ or NETWORK checks before the mysql and postgres branches pass a caller-controlled connstring to sql.Open, allowing arbitrary outbound database connections. With attacker-controlled MySQL connection options that enable local-infile access, a rogue MySQL server can request files readable by the Velociraptor server process, including root-readable files when that process runs as root. The SQLite file accessor still enforces FILESYSTEM_READ, but a low-privilege analyst with ANY_QUERY can use the zero-permission data accessor and ATTACH DATABASE to create files without the plugin-level check. This issue is fixed in version 0.77.2.

Affected: Go: www.velocidex.com/golang/velociraptor

## Summary

The `sql()` VQL plugin runs a caller-supplied database driver and connection string with no permission check (`vql/parsers/sql/sql.go:93`, `SQLPlugin.Call`). For `driver='mysql'` or `driver='postgres'` the handle comes from `GetHandleOther` (`sql.go:39`), which passes the connection string straight to Go `database/sql` `sql.Open` (`sql.go:51`) and executes the query (`sql.go:159`).

The plugin declares `FILESYSTEM_READ` only as `Info().Permissions` metadata (`sql.go:219`). That metadata is never consulted at runtime: `metadata.go:19` stores it as a string that only the documentation exporter reads (`api/reflect.go:82-110`). Every sibling network plugin (`http_client`, `netcat`, `s3`, `rsyslog`) calls `CheckAccess(acls.NETWORK)` in its own body; `sql()` calls nothing.

The built-in `analyst` role holds `ANY_QUERY` but not `FILESYSTEM_READ` or `NETWORK` (`acls/roles.go:222`), and reaches this sink through the notebook query API.

Result: a low-priv analyst opens arbitrary outbound TCP connections and, through a rogue MySQL server's `LOAD DATA LOCAL INFILE`, reads any file the root-running server can read, including the deployment CA private key.

## Affected

- Velocidex/velociraptor server, `<= v0.77.1` (latest release, 2026-06-23). Identical vulnerable code in `master` HEAD `1961e79` (2026-07-17). - Confirmed live-exploitable on the official `ghcr.io/velocidex/velociraptor-server:latest` image (build 0.77.1, commit bbe2a58). - Stock install, default Basic authent…