Path Traversal in Dataease Sqlbot
CVE-2026-121453
SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/dataease/SQLBot/issues/1434 (issue-tracking)
- github.com/dataease/SQLBot (product)
- github.com/dataease/SQLBot/commit/3d15c67b4de6ed9420daa9a34e4dc371ebbf4765 (patch)
- github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/api/datasource… (technical-description)
- github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/utils/excel.py (technical-description)
- www.vulncheck.com/advisories/sqlbot-through-1.10.3-path-traversal-via-datasourc… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-121453?
- CVE-2026-121453 is a low-severity vulnerability in Dataease Sqlbot, classified under Path Traversal. CVSS score: 2.7/10. Published 2026-11-03.
- How severe is CVE-2026-121453?
- Low severity. CVSS v3 base score is 2.7 out of 10.