PT-2026-21751 · Mindsdb · Mindsdb

Xlabaiteam · Published 2026-02-24 · Updated 2026-03-16 · CVE-2026-27483

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MindsDB versions prior to 25.9.1.1

Description MindsDB, a platform for building artificial intelligence from enterprise data, has a path traversal flaw in its /api/files interface. An authenticated attacker can exploit this to achieve remote command execution. The vulnerability resides in the "Upload File" module, specifically at the /api/files API endpoint. The system does not perform security checks on uploaded file paths, allowing attackers to use ../ sequences in the filename to perform path traversal. The file write operation occurs before filename filtering, enabling arbitrary content to be written to any location on the server. An attacker can overwrite existing executable files, potentially achieving Remote Code Execution (RCE) by overwriting files like /venv/lib/python3.10/site-packages/pip/ init .py and triggering their execution through other MindsDB functionality, such as handler installation.

Recommendations Upgrade to MindsDB version 25.9.1.1 or later to resolve this vulnerability.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-27483

GHSA-4894-XQV6-VRFQ

Affected Products

Mindsdb

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27483.json · Exploit
• 🔥 https://exploit-db.com/exploits/52547 · Exploit
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfq · Vendor Advisory
• https://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505ef · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27483 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27483 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4894-xqv6-vrfq · Vendor Advisory
• https://github.com/mindsdb/mindsdb · Note
• https://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1 · Note
• https://twitter.com/_cvereports/status/2026525140008243581 · Twitter Post
• https://twitter.com/CveTodo/status/2026321281075790035 · Twitter Post
• https://twitter.com/CveFindCom/status/2026321756399559135 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1refon9/resumen_diario_de_vulnerabilidades_25022026 · Reddit Post
• https://twitter.com/CVEnew/status/2026676472644251730 · Twitter Post
• https://twitter.com/pulsepatchio/status/2026675543584985489 · Twitter Post