Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121453SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint
Low 2.7
In plain English
A low-severity path traversal in SQLBot from dataease. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.4%top 62.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Issue #1434 issue-tracking
- https://github.com/dataease/SQLBot product
- Fix commit patch
- https://github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/api/datasource.py#L580-L585 technical-description
- https://github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/utils/excel.py#L48-L57 technical-description
- VulnCheck Advisory: SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint third-party-advisory