Executive brief
SQLBot is a database querying tool that uses AI to convert natural language to SQL queries. The parseExcel endpoint allows attackers to upload malicious spreadsheet files that bypass validation and write arbitrary Python code to the server's migration directory. When SQLBot restarts, it automatically executes this malicious code with full application privileges, enabling complete system compromise.
Technical details
The vulnerability exists in the POST /api/v1/datasource/parseExcel endpoint, which accepts multipart file uploads without proper validation of the filename. An attacker can craft a multipart upload with a double-extension filename (e.g., "malicious.py.xlsx") that exploits path traversal and filename handling to write attacker-controlled Python code to /opt/sqlbot/app/alembic/versions/. The endpoint writes file content to disk before spreadsheet parsing and validation complete, meaning malicious files persist even if validation fails. When SQLBot starts or runs migrations, Alembic automatically imports and executes module-level code from files in the versions directory, achieving arbitrary code execution. The fix in version 1.9.0 sanitizes filenames to strip path components and prevents double-extension attacks.
Affected products
- DataEase SQLBot prior to 1.9.0
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fixed in version 1.9.0