CVE-2026-32949

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32949
SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to retrieve arbitrary system and application files from the server. An attacker can exploit the /api/v1/datasource/check endpoint by configuring a forged MySQL data source with a malicious parameter extraJdbc="local_infile=1". When the SQLBot backend attempts to verify the connectivity of this data source, an attacker-controlled Rogue MySQL server issues a malicious LOAD DATA LOCAL INFILE command during the MySQL handshake. This forces the target server to read arbitrary files from its local filesystem (such as /etc/passwd or configuration files) and transmit the contents back to the attacker. This issue was fixed in version 1.7.0.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/dataease/SQLBot/commit/ff98514827bad99b8fa4b39385adecc6e3d44355 Patch
https://github.com/dataease/SQLBot/releases/tag/v1.7.0 Release Notes
https://github.com/dataease/SQLBot/security/advisories/GHSA-wqj3-xcxf-j9m9 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:fit2cloud:sqlbot:*:*:*:*:*:*:*:*
History

23 Mar 2026, 17:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:fit2cloud:sqlbot:*:*:*:*:*:*:*:*
First Time Fit2cloud sqlbot
Fit2cloud
Summary
  • (es) SQLBot es un sistema inteligente de consulta de datos basado en un modelo de lenguaje grande y RAG. Las versiones anteriores a la 1.7.0 contienen una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) que permite a un atacante recuperar archivos arbitrarios del sistema y de la aplicación del servidor. Un atacante puede explotar el endpoint /api/v1/datasource/check configurando una fuente de datos MySQL falsificada con un parámetro malicioso extraJdbc='local_infile=1'. Cuando el backend de SQLBot intenta verificar la conectividad de esta fuente de datos, un servidor MySQL Rogue controlado por el atacante emite un comando LOAD DATA LOCAL INFILE malicioso durante el handshake de MySQL. Esto obliga al servidor objetivo a leer archivos arbitrarios de su sistema de archivos local (como /etc /passwd o archivos de configuración) y a transmitir el contenido de vuelta al atacante. Este problema fue solucionado en la versión 1.7.0.
References () https://github.com/dataease/SQLBot/commit/ff98514827bad99b8fa4b39385adecc6e3d44355 - () https://github.com/dataease/SQLBot/commit/ff98514827bad99b8fa4b39385adecc6e3d44355 - Patch
References () https://github.com/dataease/SQLBot/releases/tag/v1.7.0 - () https://github.com/dataease/SQLBot/releases/tag/v1.7.0 - Release Notes
References () https://github.com/dataease/SQLBot/security/advisories/GHSA-wqj3-xcxf-j9m9 - () https://github.com/dataease/SQLBot/security/advisories/GHSA-wqj3-xcxf-j9m9 - Exploit, Vendor Advisory

20 Mar 2026, 05:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-20 05:16

Updated : 2026-03-23 17:35

NVD link : CVE-2026-32949

Mitre link : CVE-2026-32949

CVE.ORG link : CVE-2026-32949

JSON object : View

Products Affected

fit2cloud

  • sqlbot
CWE
CWE-73

External Control of File Name or Path

CWE-918

Server-Side Request Forgery (SSRF)