EUVD-2026-13541Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to retrieve arbitrary system and application files from the server. An attacker can exploit the /api/v1/datasource/check endpoint by configuring a forged MySQL data source with a malicious parameter extraJdbc="local_infile=1". When the SQLBot backend attempts to verify the connectivity of this data source, an attacker-controlled Rogue MySQL server issues a malicious LOAD DATA LOCAL INFILE command during the MySQL handshake. This forces the target server to read arbitrary files from its local filesystem (such as /etc/passwd or configuration files) and transmit the contents back to the attacker. This issue was fixed in version 1.7.0.
AnalysisAI
A Server-Side Request Forgery (SSRF) vulnerability in SQLBot, an intelligent data query system based on large language models and RAG, allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. SQLBot versions prior to 1.7.0 are affected, with the vulnerability exploitable through the /api/v1/datasource/check endpoint by configuring a malicious MySQL data source that triggers a LOAD DATA LOCAL INFILE attack during connection verification. The CVSS score of 8.7 with network-based attack vector and no privileges required indicates critical severity, though no KEV listing or EPSS data suggests exploitation in the wild has not yet been widely observed.
Technical ContextAI
This vulnerability exploits the MySQL LOAD DATA LOCAL INFILE feature through a Rogue MySQL Server attack pattern. The affected product SQLBot versions prior to 1.7.0 allow attackers to inject the extraJdbc parameter with local_infile=1 when testing MySQL data source connectivity. During the MySQL handshake protocol, an attacker-controlled malicious MySQL server can issue LOAD DATA LOCAL INFILE commands that force the SQLBot server (acting as MySQL client) to read local files and transmit their contents back to the attacker's server. This falls under CWE-73 (External Control of File Name or Path), as the attacker controls which files are accessed through the MySQL protocol's file reading capability. The vulnerability exists in the data source verification logic that does not properly sanitize JDBC connection parameters or restrict outbound MySQL connections.
RemediationAI
Upgrade SQLBot to version 1.7.0 or later, which contains the security fix as documented in the release notes at https://github.com/dataease/SQLBot/releases/tag/v1.7.0. The specific patch commit ff98514827bad99b8fa4b39385adecc6e3d44355 available at https://github.com/dataease/SQLBot/commit/ff98514827bad99b8fa4b39385adecc6e3d44355 addresses the vulnerable data source verification logic. Until patching is completed, implement network segmentation to restrict access to the /api/v1/datasource/check endpoint to trusted administrative networks only, and deploy web application firewall rules to block requests containing suspicious JDBC parameters like local_infile. Additionally, ensure outbound MySQL connections from SQLBot servers are restricted to known legitimate database servers through firewall egress filtering to prevent connections to attacker-controlled rogue MySQL servers.
SQLBot is an intelligent data query system based on a large language model and RAG. [CVSS 6.1 MEDIUM]
Prompt injection in SQLBot 1.7.0 and earlier allows authenticated attackers to execute arbitrary SQL statements through
Stored cross-site scripting in SQLBot's SQText dashboard component allows any authenticated low-privilege user who can e
Remote code execution in SQLBot 1.5.0 and below allows authenticated users to inject malicious prompts through unsanitiz
SQLBot, an intelligent data query system based on large language models and RAG, contains a critical SQL injection vulne
Cross-workspace IDOR in SQLBot (DataEase) versions prior to 1.8.0 allows authenticated low-privilege users to read and m
A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend
A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps
Server-side request forgery (SSRF) in Dataease SQLBot up to version 1.6.0 allows high-privileged remote attackers to man
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today