Platform
postgresql
Component
sqlbot
Fixed in
1.5.1
CVE-2025-69285 describes an Arbitrary File Access vulnerability affecting SQLBot versions prior to 1.5.0. This flaw allows unauthenticated attackers to upload malicious Excel or CSV files, directly injecting data into the underlying PostgreSQL database. The vulnerability stems from a missing authentication check in the /api/v1/datasource/uploadExcel endpoint, which bypasses token validation. A patch is available in version 1.5.0.
The impact of CVE-2025-69285 is significant due to the ease of exploitation and potential for data compromise. An attacker can leverage this vulnerability to inject arbitrary data into the SQLBot's PostgreSQL database without authentication. This could lead to data manipulation, corruption, or even complete database takeover. The use of tosql() with ifexists='replace' mode means that existing data can be overwritten, leading to a complete loss of information. Successful exploitation could also be used as a stepping stone for further attacks, such as gaining access to sensitive information stored within the database or pivoting to other systems on the network.
This vulnerability is publicly known and described in detail. While no active exploitation campaigns have been confirmed, the lack of authentication and the ease of file upload make it a likely target for opportunistic attackers. The vulnerability's description suggests a straightforward exploitation path, increasing the risk of rapid adoption. No KEV listing is currently available as of the publication date.
Exploit Status
EPSS
0.11% (29% percentile)
CISA SSVC
The primary mitigation for CVE-2025-69285 is to immediately upgrade SQLBot to version 1.5.0 or later, which includes the necessary authentication fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the /api/v1/datasource/uploadExcel endpoint using a Web Application Firewall (WAF) or proxy server to block unauthorized requests. Implement strict input validation on all uploaded files to prevent malicious content from being processed. Monitor PostgreSQL logs for suspicious activity, such as unexpected data modifications or connections from unknown sources. After upgrading, confirm the fix by attempting to upload a test file without authentication and verifying that the request is rejected.
Update SQLBot to version 1.5.0 or later. This version fixes the unauthenticated file upload vulnerability. No workarounds are available, so updating is the only solution.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-69285 is a vulnerability in SQLBot versions before 1.5.0 that allows unauthenticated attackers to upload arbitrary files and inject data into the PostgreSQL database due to a missing authentication check.
You are affected if you are using SQLBot versions prior to 1.5.0 and have not implemented compensating controls.
Upgrade SQLBot to version 1.5.0 or later to resolve the vulnerability. As a temporary workaround, restrict access to the /api/v1/datasource/uploadExcel endpoint using a WAF or proxy.
While no active exploitation campaigns have been confirmed, the ease of exploitation makes it a potential target for attackers.
Refer to the SQLBot project's official documentation and release notes for the advisory related to CVE-2025-69285.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.