PT-2026-8307 · Mindsdb · Mindsdb

Fushuling · Published 2026-02-16 · Updated 2026-02-16 · CVE-2026-2531

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MindsDB versions up to 25.14.1

Description A security issue exists in MindsDB related to server-side request forgery. This occurs through manipulation of the clear filename function within the mindsdb/utilities/security.py file, specifically in the File Upload component. The issue is exploitable remotely and has been publicly disclosed.

Recommendations Apply the patch with identifier 74d6f0fd4b630218519a700fbee1c05c7fd4b1ed to resolve this issue.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-2531

GHSA-6XW9-2P64-7622

PYSEC-2026-91

Affected Products

Mindsdb

References · 15

• 🔥 https://github.com/mindsdb/mindsdb/issues/12163 · Exploit
• https://github.com/mindsdb/mindsdb/pull/12213 · Patch
• https://github.com/themavik/mindsdb/commit/74d6f0fd4b630218519a700fbee1c05c7fd4b1ed · Patch
• https://osv.dev/vulnerability/GHSA-6xw9-2p64-7622 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2531 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2531 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-91 · Vendor Advisory
• https://github.com/mindsdb/mindsdb · Note
• https://t.me/CVEtracker/44786 · Telegram Post
• https://vuldb.com/?submit.748219 · Note
• https://twitter.com/CVEarity/status/2023307301608944055 · Twitter Post
• https://t.me/cveNotify/152081 · Telegram Post
• https://vuldb.com/?ctiid.346119 · Note
• https://twitter.com/VulmonFeeds/status/2023262650021331132 · Twitter Post
• https://vuldb.com/?id.346119 · Note