CVE-2026-53554: Improper Limitation of a Pathname to a Restricted Directory

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled multipart filename data when selecting where uploaded content is stored, writes...

PT-2026-95136

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description The system improperly handles multipart filename data when processing uploads. Specifically, the 'POST /api/v1/datasource/parseExcel' endpoint writes uploaded content to disk before completing...