High · published January 12, 2026
⚡ Uh-oh! An unauthenticated path traversal in MindsDB's file upload API lets anyone access sensitive files on the server before version 25.11.1! 🔥 Think of it like a delivery service that opens your mailbox without checking who’s sending the package. If the delivery person isn’t careful, anyone could peek inside and take whatever they want! This vulnerability could allow an attacker to read and move arbitrary files from the server, exposing sensitive data that might include user information, confidential documents, or even credentials. The potential fallout is absolutely devastating, as it could lead to data breaches or unauthorized access to critical resources.
Think of it like a delivery service that opens your mailbox without checking who’s sending the package. If the delivery person isn’t careful, anyone could peek inside and take whatever they want! This vulnerability arises from the PUT handler in file.py directly joining user-controlled data into a filesystem path when handling JSON data uploads. Unlike multipart or URL-sourced uploads, JSON uploads skip essential sanitization checks, allowing attackers to exploit the system without authentication.
This vulnerability could allow an attacker to read and move arbitrary files from the server, exposing sensitive data that might include user information, confidential documents, or even credentials. The potential fallout is absolutely devastating, as it could lead to data breaches or unauthorized access to critical resources. To mitigate this risk, immediately upgrade MindsDB to version 25.11.1 or higher. Additionally, review the upload processes to enforce proper sanitization across all input types, ensuring unauthorized access is prevented. This is fixable! By updating and reviewing your processes, you'll have your system locked down in no time. 🛡️