CVE-2025-68472
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. The PUT handler in file.py directly joins user-controlled data into a filesystem path when the request body is JSON and source_type is not "url". Only multipart uploads and URL-sourced uploads receive sanitization; JSON uploads lack any call to clear_filename or equivalent checks. This vulnerability is fixed in 25.11.1.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- EPSS probability
- 20.26%
- CWE
- CWE-22, CWE-23, CWE-36
- Published
- 2026-01-12
- Last modified
- 2026-03-13
Affected products
- mindsdb mindsdb
Weakness type
Related vulnerabilities
- CVE-2026-78085 — Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4
- CVE-2026-15019 — Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment
- CVE-2026-18386 — WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
- CVE-2026-88069 — Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis
- CVE-2026-53956 — Rattler vulnerable to package cache path traversal via conda package build string
- CVE-2026-86775 — knowns before 0.30.0 Path Traversal via Document API
- CVE-2026-86099 — Chainlit through 2.12.0 Path Traversal via socket.io sessionId
- CVE-2026-78485 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...