CVE-2025-68472

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. The PUT handler in file.py directly joins user-controlled data into a filesystem path when the request body is JSON and source_type is not "url". Only multipart uploads and URL-sourced uploads receive sanitization; JSON uploads lack any call to clear_filename or equivalent checks. This vulnerability is fixed in 25.11.1.

• CWE-22
• CWE-23
• CWE-36

• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-qqhf-pm3j-96g7Exploit, Vendor Advisory
• https://www.bluerock.io/post/cve-2025-68472-mindsdb-file-upload-path-traversal

Published

Jan 12, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68467Dark Reader is an accessibility browser extension that makes…3.4
• CVE-2025-68468Avahi is a system which facilitates service discovery on a l…6.5
• CVE-2025-68469ImageMagick is free and open-source software used for editin…3.3
• CVE-2025-6847A vulnerability classified as critical was found in code-pro…9.8
• CVE-2025-68470React Router is a router for React. In versions 6.0.0 throug…6.5
• CVE-2025-68471Avahi is a system which facilitates service discovery on a l…6.5
• CVE-2025-68473ESF-IDF is the Espressif Internet of Things (IOT) Developmen…8.6
• CVE-2025-68474ESF-IDF is the Espressif Internet of Things (IOT) Developmen…7.6
• CVE-2025-68475Fedify is a TypeScript library for building federated server…7.5
• CVE-2025-68476KEDA is a Kubernetes-based Event Driven Autoscaling componen…8.2
• CVE-2025-68477Langflow is a tool for building and deploying AI-powered age…6.5
• CVE-2025-68478Langflow is a tool for building and deploying AI-powered age…7.1