MindsDB up to 24.7.4.1 API Endpoint /api/files filename path traversal

Summaryinfo

A vulnerability was found in MindsDB and classified as critical. The affected element is an unknown function of the file /api/files of the component API Endpoint. Such manipulation of the argument filename leads to path traversal. This vulnerability is referenced as CVE-2026-27483. It is possible to launch the attack remotely. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in MindsDB and classified as critical. Affected by this issue is an unknown code of the file /api/files of the component API Endpoint. The manipulation of the argument filename with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-27483 since 02/19/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1006.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 25.9.1.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (52547) and EUVD (EUVD-2026-8466). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• MindsDB

Version

• 22.11.4.3
• 23.2.1.0
• 23.7.4.0
• 23.10.2.0
• 23.11.4.1
• 23.12.4.2
• 24.7.4.1

Website

• Product: https://github.com/mindsdb/mindsdb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion