CVE-2025-68472 Details
Description
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. The PUT handler in file.py directly joins user-controlled data into a filesystem path when the request body is JSON and source_type is not "url". Only multipart uploads and URL-sourced uploads receive sanitization; JSON uploads lack any call to clear_filename or equivalent checks. This vulnerability is fixed in 25.11.1.
A path traversal vulnerability has been identified in the MindsDB file upload API, prior to version 25.11.1. This vulnerability allows unauthenticated users to read arbitrary files from the server's filesystem and transfer them to MindsDB's storage, potentially exposing sensitive data. The issue arises because the PUT handler in file.py concatenates user-controlled data into a filesystem path without proper validation, specifically when the request body is in JSON format and the source_type is not 'url'. While multipart and URL-sourced uploads are sanitized, JSON uploads lack equivalent checks, leaving a critical gap that can be exploited.
Users should update to MindsDB version 25.11.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.bluerock.io/post/cve-2025-68472-mindsdb-file-upload-path-traversal | CVE | |
| https://github.com/mindsdb/mindsdb/security/advisories/GHSA-qqhf-pm3j-96g7 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-23 | Relative Path Traversal | [email protected] |
| CWE-36 | Absolute Path Traversal | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mindsdb mindsdb | < 25.11.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 20, 2026 | CVE Modified | CVE |
| Jan 27, 2026 | Initial Analysis | [email protected] |
| Jan 12, 2026 | New CVE Received | [email protected] |