CVE-2026-27483

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.

• CWE-22

• https://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505efPatch
• https://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1Product, Release Notes
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfqExploit, Vendor Advisory

Published

Feb 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27478Unity Catalog is an open, multi-modal Catalog for data and A…9.1
• CVE-2026-27479Wallos is an open-source, self-hostable personal subscriptio…7.7
• CVE-2026-2748SEPPmail Secure Email Gateway before version 15.0.1 improper…5.3
• CVE-2026-27480Static Web Server (SWS) is a production-ready web server sui…5.3
• CVE-2026-27481Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-27482Ray is an AI compute engine. In versions 2.53.0 and below, t…6.5
• CVE-2026-27484OpenClaw is a personal AI assistant. In versions 2026.2.17 a…4.3
• CVE-2026-27485OpenClaw is a personal AI assistant. In versions 2026.2.17 a…4.4
• CVE-2026-27486OpenClaw is a personal AI assistant. In versions 2026.2.13 a…5.3
• CVE-2026-27487OpenClaw is a personal AI assistant. In versions 2026.2.13 a…8
• CVE-2026-27488OpenClaw is a personal AI assistant. In versions 2026.2.17 a…7.3
• CVE-2026-27489Open Neural Network Exchange (ONNX) is an open standard for …7.5