CVE-2026-32949: FIT2CLOUD Sqlbot

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to retrieve arbitrary system and application files from the server. An attacker can exploit the /api/v1/datasource/check endpoint by configuring a forged MySQL data source with a malicious parameter extraJdbc="local_infile=1". When the SQLBot backend attempts to verify the connectivity of this data source, an attacker-controlled Rogue MySQL server issues a malicious LOAD DATA LOCAL INFILE command during the MySQL handshake. This forces the target server to read arbitrary files from its local filesystem (such as /etc/passwd or configuration files) and transmit the contents back to the attacker. This issue was fixed in version 1.7.0.

Affected products

• FIT2CLOUD Sqlbot: before 1.7.0 (fixed in 1.7.0)

Published 2026-03-20. Last modified 2026-06-17.