CVE-2026-27483
mindsdb: Path Traversal
- Track*
- CVSS 8.8 High
What it is
ReportedMindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field.…
Dates
What is affected
Reportedmindsdb; mindsdb. Product-level identification only; no affected-version conclusion is available from this field.
Dates
Urgency and basis
Tracker computedTrack*
Current priority score and EPSS: loading from the tracker record. They are read when this page loads and are not shown without JavaScript. They change daily and are not part of "Source last updated".
Dates
Exploitation evidence
Not reportedNot reported by tracked sources.
What to do
ReportedA source remediation link is available. Validate that guidance against the affected product and your environment.
Source remediation ↗Dates
Detection and validation
Mapped metadata availability only. These signals do not change priority.
Sigma
Not mapped by tracked sources.
Atomic
Not mapped by tracked sources.
Nuclei
MindsDB - Remote Code Execution. Check identifier: CVE-2026-27483.
Open Nuclei metadata
Evidence detail
Loading the full tracker evidence record…