PT-2026-8307 · Mindsdb · Mindsdb

Fushuling · Published 2026-02-16 · Updated 2026-02-16 · CVE-2026-2531

Positive Technologies · (AI Summary)

CVSS v2.0

6.5

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MindsDB versions up to 25.14.1

Description A security issue exists in MindsDB related to server-side request forgery. This occurs through manipulation of the

clear filename

function within the

mindsdb/utilities/security.py

file, specifically in the File Upload component. The issue is exploitable remotely and has been publicly disclosed.

Recommendations Apply the patch with identifier 74d6f0fd4b630218519a700fbee1c05c7fd4b1ed to resolve this issue.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-2531

Affected Products

Mindsdb

References · 12

• 🔥 https://github.com/mindsdb/mindsdb/issues/12163 · Exploit
• https://github.com/themavik/mindsdb/commit/74d6f0fd4b630218519a700fbee1c05c7fd4b1ed · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-2531 · Security Note
• https://github.com/mindsdb/mindsdb/pull/12213 · Note
• https://twitter.com/CVEarity/status/2023307301608944055 · Twitter Post
• https://github.com/mindsdb/mindsdb · Note
• https://vuldb.com/?id.346119 · Note
• https://t.me/CVEtracker/44786 · Telegram Post
• https://vuldb.com/?ctiid.346119 · Note
• https://twitter.com/VulmonFeeds/status/2023262650021331132 · Twitter Post
• https://t.me/cveNotify/152081 · Telegram Post
• https://vuldb.com/?submit.748219 · Note