Live › vulnerability › CVE-2026-121453
SQLBot through 1.10.3 has a path traversal flaw in its importToDb endpoint, where the filePath parameter is not sanitized. An authenticated workspace administrator can import arbitrary server files, including other workspaces' uploads, into queryable tables and read their contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
SQLBot deployments through 1.10.3 where workspace administrators can use the CSV or spreadsheet import feature. Exposure needs an authenticated workspace administrator account; instances where only trusted users hold admin rights carry less risk. Teams that do not run SQLBot can skip it.
No product ranges from the sources yet.
through 1.10.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.
This page as .md · .json · in your agent: get_signal("CVE-2026-121453")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.