{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-121453","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","state":"PUBLISHED","assignerShortName":"VulnCheck","dateReserved":"2026-11-03T12:33:53.717Z","datePublished":"2026-11-03T15:17:02.458Z","dateUpdated":"2026-11-03T16:52:31.501Z"},"containers":{"cna":{"providerMetadata":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-11-03T15:17:02.458Z"},"datePublic":"2026-10-31T00:00:00.000Z","title":"SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint","descriptions":[{"lang":"en","value":"SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables."}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","cweId":"CWE-22","type":"CWE"}]}],"affected":[{"vendor":"dataease","product":"SQLBot","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.10.3","versionType":"semver","status":"affected"}]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":5.1,"baseSeverity":"MEDIUM"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW"}}],"references":[{"url":"https://github.com/dataease/SQLBot/issues/1434","tags":["issue-tracking"],"name":"GitHub Issue #1434"},{"url":"https://github.com/dataease/SQLBot","tags":["product"]},{"url":"https://github.com/dataease/SQLBot/commit/3d15c67b4de6ed9420daa9a34e4dc371ebbf4765","tags":["patch"],"name":"Fix commit"},{"url":"https://github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/api/datasource.py#L580-L585","tags":["technical-description"]},{"url":"https://github.com/dataease/SQLBot/blob/v1.10.3/backend/apps/datasource/utils/excel.py#L48-L57","tags":["technical-description"]},{"name":"VulnCheck Advisory: SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/sqlbot-through-1.10.3-path-traversal-via-datasource-importtodb-endpoint"}],"credits":[{"lang":"en","value":"George Chen","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-11-03T16:52:00.512543Z","id":"CVE-2026-121453","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-03T16:52:31.501Z"}}]}}