Path Traversal Vulnerability in SQLBot by DataEase

CVE-2026-121453

What is CVE-2026-121453?

SQLBot, up to version 1.10.3, contains a path traversal vulnerability in the importToDb endpoint. This flaw allows authenticated workspace administrators to exploit an unsanitized filePath parameter, enabling them to read files from the server. Attackers can use absolute paths or traverse directories with sequences like '../', potentially gaining access to confidential files, including uploads from other workspaces. This can result in unauthorized data exposure and compromise the integrity of the database.

References