# CVE-2026-27483: MindsDB - Path Traversal

> Live exploitation tracking for CVE-2026-27483 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-27483

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** MindsDB
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** ai_mcp, web_application

## Description

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.

## CrowdSec analysis

[CVE-2026-27483](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-27483) is a path traversal vulnerability in MindsDB prior to version 25.9.1.1, affecting the /api/files endpoint. Authenticated attackers can exploit this flaw by manipulating file upload paths to write arbitrary files anywhere on the server, potentially leading to remote command execution. This vulnerability allows threat actors to bypass file type and path restrictions, posing a significant risk to data integrity and system security.

CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-27483 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/api/files` endpoint in MindsDB by uploading files with path traversal sequences in the filename, allowing them to write arbitrary files and potentially execute remote code. This attack requires authentication and targets the file upload functionality to achieve code execution on the server.

## Timeline

- 2026-02-24: CVE Published. CVE-2026-27483 is published to NVD.
- 2026-04-01: Rule Released. CrowdSec releases a rule to detect CVE-2026-27483 exploitation attempts against the CrowdSec Network.
- 2026-09-29: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-27483 for the first time.

## References

- https://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1
- https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfq
- https://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505ef
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27483.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-27483) follows observed exploitation activity for CVE-2026-27483. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.