CVE-2025-69285
Last modified
CVE-2025-69285 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a missing authentication vulnerability in the /api/v1/datasource/uploadExcel endpoint, allowing a remote unauthenticated attacker to upload arbitrary Excel/CSV files and inject data directly into the PostgreSQL database. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a missing authentication vulnerability in the /api/v1/datasource/uploadExcel endpoint, allowing a remote unauthenticated attacker to upload arbitrary Excel/CSV files and inject data directly into the PostgreSQL database. The endpoint is explicitly added to the authentication whitelist, causing the TokenMiddleware to bypass all token validation. Uploaded files are parsed by pandas and inserted into the database via to_sql() with if_exists='replace' mode. The vulnerability has been fixed in v1.5.0. No known workarounds are available.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fit2cloud | Sqlbot | < 1.5.0 |
References
- https://github.com/dataease/SQLBot/releases/tag/v1.5.0Product, Release Notes
- https://github.com/dataease/SQLBot/security/advisories/GHSA-crfm-cch4-hjpvExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-69285?
How severe is CVE-2025-69285?
How do I fix CVE-2025-69285?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-69275Dependency on Vulnerable Third-Party Component vulnerability…6.1
- CVE-2025-69276Deserialization of Untrusted Data vulnerability in Broadcom …8.8
- CVE-2025-69277libsodium before ad3004e, in atypical use cases involving ce…4.5
- CVE-2025-69278In nr modem, there is a possible system crash due to imprope…7.5
- CVE-2025-69279In nr modem, there is a possible system crash due to imprope…7.5
- CVE-2025-69284Plane is an an open-source project management tool. In plane…4.3
- CVE-2025-69286RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…9.8
- CVE-2025-69287The BSV Blockchain SDK is a unified TypeScript SDK for devel…5.4
- CVE-2025-69288Titra is open source project time tracking software. Prior t…9.1
- CVE-2025-69289Discourse is an open source discussion platform. A privilege…5.4
- CVE-2025-6929A vulnerability was found in PHPGurukul Zoo Management Syste…8.8
- CVE-2025-69290Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
Are you affected by CVE-2025-69285?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST