---
id: CVE-2026-53554
title: >-
  SQLBot is an intelligent Text-to-SQL system based on large language models and
  RAG
summary: >-
  SQLBot is an intelligent Text-to-SQL system based on large language models and
  RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in
  backend/apps/datasource/api/datasource.py uses attacker-controlled multipart
  filename …
severity: high
cvss: 7.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-22
vendor: dataease
product: SQLBot
affected:
  - SQLBot < 1.9.0
published: '2026-09-17'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:49.923'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53554'
references:
  - url: >-
      https://github.com/dataease/SQLBot/commit/4bfd0f49e8cd3df8540dd9d51d40d0e056eeeec4
    label: security-advisories@github.com
  - url: >-
      https://github.com/dataease/SQLBot/commit/92c5aea70b2eba9c1f429017639017041556843b
    label: security-advisories@github.com
  - url: 'https://github.com/dataease/SQLBot/releases/tag/v1.9.0'
    label: security-advisories@github.com
  - url: 'https://github.com/dataease/SQLBot/security/advisories/GHSA-wxv4-pw5w-wx79'
    label: security-advisories@github.com
  - url: 'https://github.com/dataease/SQLBot/security/advisories/GHSA-wxv4-pw5w-wx79'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00415
epssPercentile: 0.33132
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T13:16:36.235923Z'
cvssSource: cna
ingestedAt: '2026-09-17T22:30:21.398Z'
---

## Overview

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename data when selecting where uploaded content is stored, writes the content before spreadsheet parsing and validation finish, and can transform a double-extension filename into a Python source file. An attacker able to submit a crafted multipart upload can use these behaviors to place attacker-controlled content in /opt/sqlbot/app/alembic/versions/ even when a spreadsheet parsing failure after the file write causes the endpoint to return an error. The planted file remains on disk, and subsequent SQLBot startup or migration processing causes Alembic to import the module and execute its module-level statements in the SQLBot application runtime. This issue is fixed in version 1.9.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.