CVE-2025-68472

The record

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. The PUT handler in file.py directly joins user-controlled data into a filesystem path when the request body is JSON and source_type is not "url". Only multipart uploads and URL-sourced uploads receive sanitization; JSON uploads lack any call to clear_filename or equivalent checks. This vulnerability is fixed in 25.11.1.

Affected packages

Related vulnerabilities

• GHSA-qqhf-pm3j-96g7 MindsDB has improper sanitation of filepath that leads to information disclosure and DOS Same vulnerability
• GHSA-4894-xqv6-vrfq MindsDB: Path Traversal in /api/files Leading to Remote Code Execution Also affects mindsdb
• CVE-2026-27483 MindsDB is a platform for building artificial intelligence from enterprise data. Also affects mindsdb
• GHSA-6xw9-2p64-7622 MindsDB affected by a SSRF vulnerability Also affects mindsdb
• CVE-2026-2531 A security vulnerability has been detected in MindsDB up to 25.14.1. Also affects mindsdb
• CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
• CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
• CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22