CVE-2026-27483
Path Traversal in MindsDB /api/files Enables Remote Code Execution
Publication date: 2026-02-24
Last updated on: 2026-02-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mindsdb | mindsdb | to 25.9.1.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-27483 is a path traversal vulnerability in MindsDB's /api/files interface that affects versions prior to 25.9.1.1. The issue exists in the file upload module where the filename parameter is not properly sanitized, allowing an authenticated attacker to include '../' sequences in the filename. This enables the attacker to write files to arbitrary locations on the server, outside the intended directory."}, {'type': 'paragraph', 'content': 'Because the file write operation happens before any filename cleaning or saving logic, there is no filtering of filenames or file types, which allows arbitrary content to be written anywhere on the server. This can be exploited to overwrite critical files and achieve remote command execution.'}] [3]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can have severe impacts including remote code execution (RCE) on the server hosting MindsDB. An attacker with authentication can exploit the path traversal flaw to overwrite important executable files, such as Python package files used by the system.'}, {'type': 'paragraph', 'content': "For example, by overwriting the pip package's __init__.py file with malicious code, the attacker can execute arbitrary commands when pip is invoked, effectively gaining control over the server."}, {'type': 'paragraph', 'content': 'The vulnerability has a high CVSS score of 8.8, indicating high impact on confidentiality, integrity, and availability of the system.'}] [3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for suspicious or unauthorized file upload attempts to the /api/files endpoint, especially those containing path traversal sequences such as "../" in the filename field.'}, {'type': 'paragraph', 'content': 'Since the vulnerability requires authentication, reviewing authenticated API requests to /api/files for filenames with directory traversal patterns is critical.'}, {'type': 'paragraph', 'content': 'Network detection can involve inspecting HTTP PUT requests to /api/files for multipart/form-data uploads with filenames containing "../" sequences.'}, {'type': 'list_item', 'content': "Use web server or application logs to search for suspicious filenames: grep -r '\\.\\./' /path/to/mindsdb/logs"}, {'type': 'list_item', 'content': 'Capture and analyze network traffic for PUT requests to /api/files with suspicious filenames using tools like tcpdump or Wireshark.'}, {'type': 'list_item', 'content': "Example command to search logs for path traversal attempts: grep -i 'PUT /api/files' /var/log/mindsdb/access.log | grep '\\.\\./'"}, {'type': 'list_item', 'content': 'Check for unexpected file modifications or creations outside the intended upload directory, especially in critical system paths.'}] [3]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade MindsDB to version 25.9.1.1 or later, where the vulnerability has been patched.
The patch includes validation and sanitization of uploaded filenames to prevent path traversal, improved file handling, and stricter multipart form parsing.
Until the upgrade can be applied, restrict access to the /api/files endpoint to trusted authenticated users only, and monitor for suspicious upload activity.
Consider implementing additional application-level controls to validate and sanitize filenames before processing uploads.
Review and restrict permissions on directories where files are uploaded to minimize potential damage from arbitrary file writes.