CVE-2025-69285— SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability
Quick assessment
Affected
dataease SQLBot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SQLBot是DataEase开源的一个基于大模型和RAG的智能问数系统。 SQLBot 1.5.0之前版本存在访问控制错误漏洞，该漏洞源于/api/v1/datasource/uploadExcel端点缺少身份验证，可能导致未经身份验证的攻击者上传任意文件并注入数据到数据库。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-69285
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a missing authentication vulnerability in the /api/v1/datasource/uploadExcel endpoint, allowing a remote unauthenticated attacker to upload arbitrary Excel/CSV files and inject data directly into the PostgreSQL database. The endpoint is explicitly added to the authentication whitelist, causing the TokenMiddleware to bypass all token validation. Uploaded files are parsed by pandas and inserted into the database via to_sql() with if_exists='replace' mode. The vulnerability has been fixed in v1.5.0. No known workarounds are available.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
SQLBot 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SQLBot是DataEase开源的一个基于大模型和RAG的智能问数系统。 SQLBot 1.5.0之前版本存在访问控制错误漏洞，该漏洞源于/api/v1/datasource/uploadExcel端点缺少身份验证，可能导致未经身份验证的攻击者上传任意文件并注入数据到数据库。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-69285
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-69285
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: SQLBot
-
CVE-2026-93660
SQLBot through 1.10.1 Improper Access Control via Dashboard -
CVE-2026-53557
SQLBot: Second-Order SQL Injection via Excel Datasource Lead -
CVE-2026-53555
Stored XSS via SVG Upload -
CVE-2026-53556
SQLBot: Authenticated SQL Injection in previewData Resulting -
CVE-2026-53554
SQLBot: Arbitrary File Write via parseExcel Leading to Code
Same vendor: dataease
-
CVE-2026-102755
DataEase Datasource/Dataset Folder Name Stored Cross-Site Sc -
CVE-2026-102756
DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site -
CVE-2026-104143
DataEase: Stored SQL Injection via dateFormat field template -
CVE-2026-104142
DataEase: Stored SQL Injection in group-field binning bounds -
CVE-2026-104141
DataEase: SQL Injection in datasource metadata identifiers
Same weakness: CWE-306
-
CVE-2026-113358
LavaLite CMS through 10.1.2 Missing Authentication via Filer -
CVE-2026-75753
ASUS 路由器固件关键功能缺失认证漏洞 -
CVE-2026-77932
DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/re -
CVE-2026-75128
Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via / -
CVE-2026-109442
piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agen
V. Comments for CVE-2025-69285
No comments yet