CVE-2026-121453: SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint

Deferred

Published 03-11-2026Last modified 03-11-2026

Vulnerability summary

CVE-2026-121453 is a medium (CVSS 5.1) vulnerability in dataease sqlbot.

Priority

Routine

Not severe (CVSS 5.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.1/10

010

Medium · v4.0 (CVE.org)

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

03-11-2026
PublishedVulnerability first disclosed.
03-11-2026
Last modifiedVulnerability information updated.

Description

SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.

CVSS metrics

4 scores · 2 sources · 2 versions

v4.05.1v3.12.7

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Dataease1 product

sqlbot≤ 1.10.3

1 vendor · 1 product

References

6 links

github.com/dataease/SQLBot/issues/1434Issue Tracking
github.com/dataease/SQLBotProduct
github.com/dataease/SQLBot/commit/3d15c67b4de6ed9420daa9a34e4dc371ebbf4765Patch
github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/api/datasource.pyTechnical Description
github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/utils/excel.pyTechnical Description
www.vulncheck.com/advisories/sqlbot-through-1.10.3-path-traversal-via-datasource-importtodb-endpointThird Party Advisory