Skip to content
Heist/ feed
Back to feed
High

MindsDB has Path Traversal in /api/files Leading to Remote Code Execution

Type: advisorySources: OSV

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-27483
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 00:53 UTC · Revision 1

Source evidence

MindsDB has Path Traversal in /api/files Leading to Remote Code Execution

core-osv · Original source

Published 24 Feb 2026, 14:00 UTC

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.

osv:CVE-2026-27483
Complete source record
{
  "id": "2fba1b72c568c423a1e574e7b1460f4ed48e035999aca2d8dbc7a4c4f43a12c9",
  "url": "https://osv.dev/vulnerability/CVE-2026-27483",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "MindsDB has Path Traversal in /api/files Leading to Remote Code Execution",
    "summary": "MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the \"Upload File\" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.",
    "evidence": "osv:CVE-2026-27483",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-27483",
      "aliases": [
        "CVE-2026-27483",
        "GHSA-4894-xqv6-vrfq",
        "PYSEC-2026-2205"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/mindsdb/mindshub",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "303d2ae7dc0b68b1609ac759053bad36c01e486d"
                },
                {
                  "fixed": "87a44bdb2b97f963e18f10a068e1a1e2690505ef"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "25.9.1.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "87a44bdb2b97f963e18f10a068e1a1e2690505ef"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "303d2ae7dc0b68b1609ac759053bad36c01e486d"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v25.9.1.1"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v25.8.2.0",
            "v25.9.1.0",
            "v25.8.3.0",
            "v25.7.4.0",
            "v25.7.3.0",
            "v25.7.2.0",
            "v25.7.1.0",
            "v25.6.4.0",
            "v25.6.3.1",
            "v25.6.3.0",
            "v25.6.2.0",
            "v25.5.4.2",
            "v25.5.4.1",
            "v25.5.4.0",
            "v25.5.3.0",
            "v25.4.5.0",
            "v25.4.4.0",
            "v25.4.3.1",
            "v25.4.3.0",
            "v25.4.2.1",
            "v25.4.2.0",
            "v25.4.1.0",
            "v25.3.4.2",
            "v25.3.4.1",
            "v25.3.4.0",
            "v25.3.3.0",
            "v25.3.2.0",
            "v25.3.1.0",
            "v25.2.4.0",
            "v25.2.3.0",
            "v25.2.2.2",
            "v25.2.2.1",
            "v25.2.2.0",
            "v25.2.1.2",
            "v25.2.1.1",
            "v25.2.1.0",
            "v25.1.5.3",
            "v25.1.5.2",
            "v25.1.5.1",
            "v25.1.5.0",
            "v25.1.4.0",
            "v25.1.3.0",
            "v25.1.2.1",
            "v25.1.2.0",
            "v24.12.4.0",
            "v24.12.2.1",
            "v24.12.3.0",
            "v24.12.2.0",
            "v24.12.1.0",
            "v24.11.4.2",
            "v24.11.4.1",
            "v24.11.4.0",
            "v24.11.3.0",
            "v24.11.2.0",
            "v24.11.1.1",
            "v24.11.1.0",
            "v24.10.5.0",
            "v24.10.4.2",
            "v24.10.4.1",
            "v24.10.4.0",
            "v24.10.3.0",
            "v24.10.2.0",
            "v24.10.1.0",
            "v24.9.4.1",
            "v24.9.4.0",
            "v24.9.3.2",
            "v24.9.3.1",
            "v24.9.3.0",
            "v24.9.2.1",
            "v24.9.2.0",
            "v24.9.1.0",
            "v24.8.4.0",
            "v24.8.3.0",
            "v24.8.2.0",
            "v24.8.1.1",
            "v24.8.1.0",
            "v24.7.5.0",
            "v24.7.4.1",
            "v24.7.4.0",
            "v24.7.3.0",
            "v24.7.2.0",
            "v24.7.1.0",
            "v24.5.4.0",
            "v24.6.4.1",
            "v24.6.4.0",
            "v24.6.3.1",
            "v24.6.3.0",
            "v24.6.2.2",
            "v24.6.2.0",
            "v24.6.1.1",
            "v24.6.1.0",
            "v23.11.4.4a1",
            "v23.11.28.1-alpha",
            "v22.12.4.0",
            "v22.11.4.3",
            "v22.11.4.2",
            "v22.11.4.1",
            "v22.11.4.0",
            "v22.5.1.2",
            "v2.45.2",
            "v2.45.1",
            "v2.45.0",
            "v2.44.0",
            "v2.43.0",
            "v2.42.2",
            "v2.42.1",
            "v2.42.0",
            "v2.41.2",
            "v2.41.1",
            "v2.41.0",
            "v2.40.0",
            "v2.39.0",
            "2.38.0",
            "2.37.0",
            "2.36.0v2",
            "2.36.0",
            "v2.35.0",
            "2.33.0",
            "2.31.0",
            "v2.30.1",
            "2.30.0",
            "v2.27.0",
            "v2.26.0",
            "2.21.2",
            "2.21.1",
            "2.21.0",
            "2.20.1",
            "v2.17.1",
            "v2.15.0",
            "v2.14.0",
            "2.14.0",
            "v2.11.2",
            "v2.11.1",
            "v2.11.0",
            "v2.10.2",
            "v2.10.0",
            "v2.9.1",
            "v2.9.0",
            "v2.8.3",
            "v2.8.1",
            "v2.8.0",
            "v2.7.2",
            "v2.7.1",
            "v2.7.0",
            "v2.6.1",
            "v2.6.0",
            "v2.5.0",
            "v2.4.0",
            "v2.3.0",
            "v2.2.1",
            "v2.2.0",
            "v2.1.2",
            "v2.1.1",
            "v2.1.0",
            "v2.0.0",
            "v1.0.6",
            "v0.8.9.1",
            "v0.8.8"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27483.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:52.489046011Z",
      "provider": "osv",
      "references": [
        "https://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27483.json",
        "https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfq",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-27483",
        "https://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505ef"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27483.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-27483",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 521118,
  "published_at": "2026-02-24T14:00:05.402+00:00"
}