MindsDB - Path Traversal (CVE-2026-27483)
Description
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using ../ sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.
psychologyCrowdSec Analysis
CVE-2026-27483 is a path traversal vulnerability in MindsDB prior to version 25.9.1.1, affecting the /api/files endpoint. Authenticated attackers can exploit this flaw by manipulating file upload paths to write arbitrary files anywhere on the server, potentially leading to remote command execution. This vulnerability allows threat actors to bypass file type and path restrictions, posing a significant risk to data integrity and system security.
CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-27483 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /api/files endpoint in MindsDB by uploading files with path traversal sequences in the filename, allowing them to write arbitrary files and potentially execute remote code. This attack requires authentication and targets the file upload functionality to achieve code execution on the server.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-02-24 |
| Rule Released | 2026-04-01 |
| CrowdSec First Seen | 2026-09-29 |
Remediation & Protection
External References
- https://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1
- https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfq
- https://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505ef
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27483.yaml