CVE-2026-121453

LowCVSS 2.7/10Last modified Nov 3, 2026

Description

SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 3, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1214543.7Padloc before 4.3.1 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to CVE-2026-1214555.4DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PER CVE-2026-1214586.5Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authentica CVE-2026-1214725.0The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration connections to the a CVE-2026-121488.8IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted CVE-2026-12148910.0Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryRe CVE-2026-1214919.0The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates CVE-2026-1214925.3The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users CVE-2026-1214979.8The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browse CVE-2026-1214984.8The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allo CVE-2026-12154.3The MMA Call Tracking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.15. This is CVE-2026-121507.0IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through