MindsDB: Path Traversal in /api/files Leading to Remote Code Execution
Date: 2026-02
Affected: pip/mindsdb
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-27483
CWE: CWE-22
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

### Summary There is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. ### Details The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. The affected code is located at mindsdb/api/http/namespaces/file.py: ```python @ns_conf.route("/<name>") @ns_conf.param("name", "MindsDB's name for file") class File(Resource): @ns_conf.doc("put_file") @api_endpoint_metrics('PUT', '/files/file') def put(self, name: str): """add new file params in FormData: - file - original_file_name [optional] """ data = {} mindsdb_file_name = name existing_file_names = ca.file_controller.get_files_names() def on_field(field): name = field.field_name.decode() value = field.value.decode() data[name] = value file_object = None def on_file(file): nonlocal file_object data["file"] = file.file_name.decode() file_object = file.file_object temp_dir_path = tempfile.mkdtemp(prefix="mindsdb_file_") if request.headers["Content-Type"].startswith("multipart/form-data"): parser = multipart.create_form_parser( headers=request.headers, on_field=on_field, on_file=on_file, config={ "U


Mitigations:

Architectural layers (MAESTRO):