MindsDB up to 25.11.0 PUT file.py source_type path traversal

Summaryinfo

A vulnerability was found in MindsDB up to 25.11.0 and classified as critical. Affected by this issue is some unknown functionality of the file file.py of the component PUT Handler. Such manipulation of the argument source_type leads to path traversal. This vulnerability is traded as CVE-2025-68472. Access to the local network is required for this attack to succeed. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in MindsDB up to 25.11.0 and classified as critical. Affected by this issue is an unknown code of the file file.py of the component PUT Handler. The manipulation of the argument source_type with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality. CVE summarizes:

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. The PUT handler in file.py directly joins user-controlled data into a filesystem path when the request body is JSON and source_type is not "url". Only multipart uploads and URL-sourced uploads receive sanitization; JSON uploads lack any call to clear_filename or equivalent checks. This vulnerability is fixed in 25.11.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-68472 since 12/18/2025. The exploitation is known to be easy. The attack needs to be initiated within the local network. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 25.11.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-1922). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• MindsDB

Version

• 25.0
• 25.1
• 25.2
• 25.3
• 25.4
• 25.5
• 25.6
• 25.7
• 25.8
• 25.9
• 25.10
• 25.11.0

Website

• Product: https://github.com/mindsdb/mindsdb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion