{"id":"CVE-2026-121453","kind":"vulnerability","aliases":["CVE-2026-121453"],"related":[],"title":"SQLBot: path traversal in importToDb lets admins read server files","description":"SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.","summary":"SQLBot through 1.10.3 has a path traversal flaw in its importToDb endpoint, where the filePath parameter is not sanitized. An authenticated workspace administrator can import arbitrary server files, including other workspaces' uploads, into queryable tables and read their contents.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","self-hosted","sqlbot","text-to-sql"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed SQLBot version against the affected range `through 1.10.3`\n- Review whether the importToDb endpoint is reachable by workspace administrators in your deployment","fix":"- Fixed version: unknown (the Patch link is listed in the sources, but the version is not stated)","status":"open","published_at":"2026-11-03T16:17:24+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","triaged_at":"2026-11-03T16:24:20+00:00","updated_at":"2026-11-03T16:24:20+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-03T16:24:20Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed version: unknown (the Patch link is listed in the sources, but the version is not stated)","reach":"network","title":"SQLBot: path traversal in importToDb lets admins read server files","impact":"medium","summary":"SQLBot through 1.10.3 has a path traversal flaw in its importToDb endpoint, where the filePath parameter is not sanitized. An authenticated workspace administrator can import arbitrary server files, including other workspaces' uploads, into queryable tables and read their contents.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["sqlbot","self-hosted","text-to-sql"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"server files and other workspaces' uploads readable by admin","analyst_note":"Confirm the fixed version from the linked Patch on github.com and whether the import feature is enabled by default.","how_to_check":"- Check the installed SQLBot version against the affected range `through 1.10.3`\n- Review whether the importToDb endpoint is reachable by workspace administrators in your deployment\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"who_is_affected":"SQLBot deployments through 1.10.3 where workspace administrators can use the CSV or spreadsheet import feature. Exposure needs an authenticated workspace administrator account; instances where only trusted users hold admin rights carry less risk. Teams that do not run SQLBot can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4188,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121453':13A,16A '-2026':12A,15A '1.10.3':30B,69C 'absolut':95C 'admin':7A 'administr':50B,83C 'ai':18B 'ai-tool':17B 'allow':80C 'arbitrari':53B 'attack':92C 'authent':48B,81C 'contain':70C 'content':66B 'csv':101C 'cve':11A,14A 'endpoint':39B,78C 'excel':114C 'file':10A,55B,86C,104C,111C 'filepath':42B,90C 'flaw':35B 'host':22B 'import':52B,100C 'importtodb':5A,38B,77C 'includ':56B,105C 'let':6A 'paramet':43B,91C 'path':2A,33B,72C,96C 'queryabl':61B,113C 'read':8A,64B,85C 'sanit':46B 'self':21B 'self-host':20B 'sequenc':98C 'server':9A,54B,110C 'spreadsheet':103C 'sql':27B 'sqlbot':1A,23B,28B,67C 'suppli':94C 'tabl':62B,115C 'text':25B 'text-to-sql':24B 'tool':19B 'travers':3A,34B,73C 'unsanit':89C 'upload':59B,108C 'via':87C 'vulner':74C 'workspac':49B,58B,82C,107C","nicknames":[],"mitigations":[],"who_affected":"SQLBot deployments through 1.10.3 where workspace administrators can use the CSV or spreadsheet import feature. Exposure needs an authenticated workspace administrator account; instances where only trusted users hold admin rights carry less risk. Teams that do not run SQLBot can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","medium","selfhosted","sqlbot","texttosql"],"first_public_at":"2026-11-03T16:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121453","severity":null,"published_at":"2026-11-03T16:17:24+00:00","modified_at":"2026-11-03T16:17:24+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","fetched_at":"2026-11-03T16:21:43+00:00","note":null}],"documents":[{"id":58815,"url":"https://github.com/dataease/SQLBot/commit/3d15c67b4de6ed9420daa9a34e4dc371ebbf4765","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58816,"url":"https://www.vulncheck.com/advisories/sqlbot-through-1.10.3-path-traversal-via-datasource-importtodb-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}