CVE-2023-50731

MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. Later in the method, the temporary directory is deleted on line 151, but since we can write outside of the directory using the path injection vulnerability, the potentially dangerous file is not deleted. Arbitrary file contents can be written due to `f.write(chunk)` on line 125. Mindsdb does check later on line 149 in the `save_file` method in `file-controller.py` which calls the `_handle_source` method in `file_handler.py` if a file is of one of the types `csv`, `json`, `parquet`, `xls`, or `xlsx`. However, since the check happens after the file has already been written, the files will still exist (and will not be removed due to the path injection described earlier), just the `_handle_source` method will return an error. The same user-controlled source source is used also in another path injection sink on line 138. This leads to another path injection, which allows an attacker to delete any `zip` or `tar.gz` files on the server.

• CWE-918
• CWE-22

• https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125Product
• https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L138Product
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-j8w6-2r9h-cxhjThird Party Advisory
• https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb/Exploit, Third Party Advisory
• https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125Product
• https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L138Product
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-j8w6-2r9h-cxhjThird Party Advisory
• https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb/Exploit, Third Party Advisory

Published

Dec 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-50726Argo CD is a declarative, GitOps continuous delivery tool fo…6.4
• CVE-2023-50727Resque is a Redis-backed Ruby library for creating backgroun…6.1
• CVE-2023-50728octokit/webhooks is a GitHub webhook events toolset for Node…7.5
• CVE-2023-50729Traccar is an open source GPS tracking system. Prior to 5.11…9.8
• CVE-2023-5073The iframe forms plugin for WordPress is vulnerable to Store…5.4
• CVE-2023-50730Grackle is a GraphQL server written in functional Scala, bui…7.5
• CVE-2023-50732XWiki Platform is a generic wiki platform offering runtime s…6.3
• CVE-2023-50733A Server-Side Request Forgery (SSRF) vulnerability has been …8.6
• CVE-2023-50734A buffer overflow vulnerability has been identified in PostS…9
• CVE-2023-50735A heap corruption vulnerability has been identified in PostS…9
• CVE-2023-50736A memory corruption vulnerability has been identified in Pos…9
• CVE-2023-50737The SE menu contains information used by Lexmark to diagnose…9.1