« Volver al listado

CVE-2026-27483

Estado: AnalizadaAlta (8.8)—

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field.

Leer descripción completaMostrar menos

The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:L/AC:L: acceso remoto autenticado sin interacción. Path traversal (CWE-22) permite escribir archivos arbitrarios → RCE. Impactos: ejecución de comandos y lectura de datos empresariales.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentNetwork Segmentation

Tecnologías afectadas (1)

Mindsdb — Mindsdb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-27483",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-27483",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-27T18:19:02.972702Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "mindsdb",
          "product": "mindsdb",
          "versions": [
            {
              "status": "affected",
              "version": "< 25.9.1.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-24T15:21:38.060",
  "references": [
    {
      "url": "https://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505ef",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfq",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the \"Upload File\" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue."
    },
    {
      "lang": "es",
      "value": "MindsDB es una plataforma para construir inteligencia artificial a partir de datos empresariales. Antes de la versión 25.9.1.1, existe una vulnerabilidad de salto de ruta en la interfaz /api/files de MindsDB, que un atacante autenticado puede explotar para lograr la ejecución remota de comandos. La vulnerabilidad existe en el módulo 'Cargar archivo', que corresponde al endpoint de la API /api/files. Dado que la carga de archivos multipart no realiza comprobaciones de seguridad en la ruta del archivo cargado, un atacante puede realizar un salto de ruta mediante el uso de secuencias '../' en el campo del nombre de archivo. La operación de escritura de archivos ocurre antes de llamar a clear_filename y save_file, lo que significa que no hay filtrado de nombres de archivo o tipos de archivo, permitiendo que se escriba contenido arbitrario en cualquier ruta del servidor. La versión 25.9.1.1 corrige el problema."
    }
  ],
  "lastModified": "2026-06-17T10:27:13.927",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF40BEB1-6A28-403A-8AC1-6488A2EF402D",
              "versionEndExcluding": "25.9.1.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}