CVE-2026-53554

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0

Description The system improperly handles multipart filename data when processing uploads. Specifically, the 'POST /api/v1/datasource/parseExcel' endpoint writes uploaded content to disk before completing spreadsheet parsing and validation. This allows an attacker to use a double-extension filename to save a Python source file into the /opt/sqlbot/app/alembic/versions/ directory. Because the file remains on disk even if the parsing process fails, subsequent application startup or migration processing triggers Alembic to import the module and execute its statements within the application runtime.

Recommendations Update SQLBot to version 1.9.0. Restrict access to the 'POST /api/v1/datasource/parseExcel' endpoint to minimize the risk of exploitation.