CVE-2026-27483

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505ef	Patch
https://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1	Product Release Notes
https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfq	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-24 15:21

Updated : 2026-02-26 15:35

NVD link : CVE-2026-27483

Mitre link : CVE-2026-27483

CVE.ORG link : CVE-2026-27483

JSON object : View

Products Affected

mindsdb

mindsdb

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-27483", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2026-02-24T15:21:38.060", "references": [{"url": "https://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505ef", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfq", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the \"Upload File\" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue."}, {"lang": "es", "value": "MindsDB es una plataforma para construir inteligencia artificial a partir de datos empresariales. Antes de la versi\u00f3n 25.9.1.1, existe una vulnerabilidad de salto de ruta en la interfaz /api/files de MindsDB, que un atacante autenticado puede explotar para lograr la ejecuci\u00f3n remota de comandos. La vulnerabilidad existe en el m\u00f3dulo 'Cargar archivo', que corresponde al endpoint de la API /api/files. Dado que la carga de archivos multipart no realiza comprobaciones de seguridad en la ruta del archivo cargado, un atacante puede realizar un salto de ruta mediante el uso de secuencias '../' en el campo del nombre de archivo. La operaci\u00f3n de escritura de archivos ocurre antes de llamar a clear_filename y save_file, lo que significa que no hay filtrado de nombres de archivo o tipos de archivo, permitiendo que se escriba contenido arbitrario en cualquier ruta del servidor. La versi\u00f3n 25.9.1.1 corrige el problema."}], "lastModified": "2026-02-26T15:35:44.480", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF40BEB1-6A28-403A-8AC1-6488A2EF402D", "versionEndExcluding": "25.9.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}