CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2025-68472Public Exploit

MindsDB - Path Traversal (CVE-2025-68472)

PublishedJan 12, 2026
First SeenN/A
Last Seen
Reported
CVSS8.1
MindsDB
MindsDBMindsDB
enterprise_softwareweb_application

Description

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. The PUT handler in file.py directly joins user-controlled data into a filesystem path when the request body is JSON and source_type is not "url". Only multipart uploads and URL-sourced uploads receive sanitization; JSON uploads lack any call to clear_filename or equivalent checks. This vulnerability is fixed in 25.11.1.

psychologyCrowdSec Analysis

CVE-2025-68472 is a high-severity path traversal vulnerability in MindsDB versions prior to 25.11.1. An unauthenticated attacker with adjacent network access can exploit the file upload API to read arbitrary files and move them into MindsDB storage, potentially enabling sensitive data exposure, unauthorized file manipulation, and service disruption.

CrowdSec has been tracking this vulnerability and its exploits since 9th of September 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-68472 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target /api/files/leak_rel with a JSON file parameter containing directory-traversal sequences such as ../../../../../etc/passwd, then query /api/sql/query to retrieve the exposed file through the files.leak_rel table.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2026-01-12
Rule Released2026-09-09

Related Weaknesses

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References