Is CVE-2026-121453 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121453?

CVE-2026-121453 has a CVSS v3 severity of LOW (2.7).

Back

CVE-2026-121453

Description

SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.