CVE-2025-69285
BaseFortify
Publication date: 2026-01-21
Last updated on: 2026-02-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fit2cloud | sqlbot | to 1.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69285 is a vulnerability in SQLBot versions prior to 1.5.0 where the /api/v1/datasource/uploadExcel endpoint lacks proper authentication. This endpoint is whitelisted, causing the system to bypass token validation, allowing remote attackers to upload arbitrary Excel or CSV files without authentication. These files are then parsed and inserted directly into the PostgreSQL database, replacing existing tables. This enables attackers to inject arbitrary data, potentially poisoning the database and AI components relying on it. [1]
How can this vulnerability impact me? :
The vulnerability allows remote unauthenticated attackers to upload arbitrary files that overwrite database tables, leading to database pollution, potential stored cross-site scripting (XSS) attacks, poisoning of AI or large language model components that depend on the database, and disk exhaustion since uploaded files are not deleted. This can compromise data integrity and system stability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by attempting an unauthenticated POST request to the /api/v1/datasource/uploadExcel endpoint to see if arbitrary Excel or CSV files can be uploaded without authentication. For example, using curl, you can run a command similar to: curl -X POST -F '[email protected]' http://<target-host>/api/v1/datasource/uploadExcel and check if you receive an HTTP 200 response indicating the file upload and table creation succeeded. This confirms the presence of the vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade SQLBot to version 1.5.0 or later, where this vulnerability has been fixed. No known workarounds are available, so applying the official patch by upgrading is the recommended action. [1, 2]