---
id: CVE-2026-121453
title: SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint
summary: >-
  SQLBot through 1.10.3 contains a path traversal vulnerability in the
  importToDb endpoint that allows authenticated workspace administrators to read
  files via an unsanitized filePath parameter. Attackers can supply absolute
  paths or ../ s…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: dataease
product: SQLBot
affected:
  - SQLBot <= 1.10.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T16:52:00.512543Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T16:52:31.501Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121453'
references:
  - url: 'https://github.com/dataease/SQLBot/issues/1434'
    label: 'GitHub Issue #1434'
  - url: 'https://github.com/dataease/SQLBot'
  - url: >-
      https://github.com/dataease/SQLBot/commit/3d15c67b4de6ed9420daa9a34e4dc371ebbf4765
    label: Fix commit
  - url: >-
      https://github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/api/datasource.py#L580-L585
  - url: >-
      https://github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/utils/excel.py#L48-L57
  - url: >-
      https://www.vulncheck.com/advisories/sqlbot-through-1.10.3-path-traversal-via-datasource-importtodb-endpoint
    label: >-
      VulnCheck Advisory: SQLBot through 1.10.3 Path Traversal via datasource
      importToDb Endpoint
tags:
  - cve.org
epss: 0.00436
epssPercentile: 0.38096
ingestedAt: '2026-11-05T20:33:06.289Z'
---

## Overview

SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.

## Affected

- `SQLBot <= 1.10.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.