GHSA-4894-xqv6-vrfq
High · 8.8CVSS
8.8
EPSS
—
Published
Feb 24, 2026
CISA due date
—
The record
MindsDB: Path Traversal in /api/files Leading to Remote Code Execution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | mindsdb | 0 | 25.9.1.1 |
Related vulnerabilities
- CVE-2026-27483 MindsDB is a platform for building artificial intelligence from enterprise data. Same vulnerability
- GHSA-6xw9-2p64-7622 MindsDB affected by a SSRF vulnerability Also affects mindsdb
- CVE-2026-2531 A security vulnerability has been detected in MindsDB up to 25.14.1. Also affects mindsdb
- CVE-2025-68472 MindsDB is a platform for building artificial intelligence from enterprise data. Also affects mindsdb
- GHSA-qqhf-pm3j-96g7 MindsDB has improper sanitation of filepath that leads to information disclosure and DOS Also affects mindsdb
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
- CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22