CVE-2026-121453mediumCWE-22

CVE-2026-121453: falha de média gravidade em dataease SQLBot

SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint

Publicada em

Seguir esta CVE+ Monitorar SQLBot

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.4%
SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
dataease · SQLBot
CVEs relacionadas — dataease SQLBot

No mesmo produto, das mais perigosas para as menos.

CVE-2026-32950HIGHSQLBot: RCE via SQL Injection in Excel Upload EndpointEPSS 0.9%CVE-2026-33324CRITICALSQLBot prompt injection allows arbitrary SQL execution and remote code executionEPSS 0.6%CVE-2026-32622HIGHSQLBot: Remote Code Execution via Terminology PoisoningEPSS 0.6%CVE-2026-53555MEDIUMStored XSS via SVG UploadEPSS 0.5%CVE-2026-53556MEDIUMSQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File ReadEPSS 0.5%CVE-2025-69285HIGHSQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerabilityEPSS 0.5%