PT-2026-3859 · Pandas+2 · Pandas+2

Published 2026-01-21 · Updated 2026-02-02 · CVE-2025-69285

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.5.0

Description SQLBot is an intelligent data query system based on a large language model and RAG. A missing authentication check in the /api/v1/datasource/uploadExcel endpoint allows unauthenticated remote attackers to upload arbitrary Excel or CSV files and inject data directly into the PostgreSQL database. The endpoint bypasses token validation due to being explicitly whitelisted. Uploaded files are parsed using pandas and inserted into the database via the to sql() function with the if exists='replace' option.

Recommendations Update to version 1.5.0 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-69285

GHSA-CRFM-CCH4-HJPV

Affected Products

Postgresql

Sqlbot

Pandas

References · 9

• 🔥 https://github.com/dataease/SQLBot/security/advisories/GHSA-crfm-cch4-hjpv · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69285.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-69285 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69285 · Vendor Advisory
• https://github.com/dataease/SQLBot/releases/tag/v1.5.0 · Note
• https://twitter.com/CVEnew/status/2014081577634926719 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014148707873169917 · Twitter Post
• https://t.me/cveNotify/150556 · Telegram Post
• https://t.me/CVEtracker/42688 · Telegram Post