Sign in
Deutsch English Español Polski
High

A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. Such

  • Disclosed: 16.02.2026
  • Updated: 11.10.2026 12:20

A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 74d6f0fd4b630218519a700fbee1c05c7fd4b1ed. It is best practice to apply a patch to resolve this issue.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) mindsdb < 26.0.0rc1 26.0.0rc1

References

CVSS score 7.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE)
CWE-918
Platform
Python (PyPI)
Package
mindsdb
Disclosed
16.02.2026
Updated
11.10.2026 12:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-6xw9-2p64-7622 - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-91 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: mindsdb

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (22) in the archive
Total entries
22
First → latest
03.2023 05.2026
Without a fix
7
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 16
  • Medium 5

Disclosures per year

Severity:
  1. MindsDB: Path Traversal in /api/files Leading to Remote Code Execution
    High · 8.8 CVE-2026-27483 < 25.9.1.1 25.9.1.1
  2. A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. Such this entry
    High · 7.3 CVE-2026-2531 < 26.0.0rc1 26.0.0rc1
  3. MindsDB has improper sanitation of filepath that leads to information disclosure and DOS
    High · 8.1 CVE-2025-68472 < 25.11.1 25.11.1
  4. MindsDB Eval Injection vulnerability
    High · 8.8 CVE-2024-45847 >= 23.11.4.2, < 24.7.4.1 24.7.4.1
  5. Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘fin
    High · 7.5 CVE-2024-45855 >= 23.10.2.0 no fix
  6. Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describ
    High · 7.5 CVE-2024-45854 >= 23.10.3.0 no fix
  7. An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases creat
    High · 8.8 CVE-2024-45851 >= 23.10.5.0, < 24.7.4.1 24.7.4.1
  8. An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’
    High · 8.8 CVE-2024-45848 >= 23.12.4.0, < 24.7.4.1 24.7.4.1
  9. Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with.
    High · 8.8 CVE-2024-45852 >= 23.3.2.0 no fix
  10. An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases creat
    High · 8.8 CVE-2024-45849 >= 23.10.5.0, < 24.7.4.1 24.7.4.1
  11. An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases creat
    High · 8.8 CVE-2024-45850 >= 23.10.5.0, < 24.7.4.1 24.7.4.1
  12. Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a
    High · 7.5 CVE-2024-45853 >= 23.10.2.0 no fix
  13. An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT
    High · 8.8 CVE-2024-45846 >= 23.10.3.0, < 24.7.4.1 24.7.4.1
  14. MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
    High · 9.3 CVE-2024-24759 < 23.12.4.2 23.12.4.2
  15. GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182
    High · 9.1 CVE-2023-50731 < 23.11.4.1 23.11.4.1
  16. MindsDB can be made to not verify SSL certificates
    Critical · 9.1 CVE-2023-38699 < 23.7.4.0 23.7.4.0
  17. mindsdb arbitrary file write when extracting a remotely retrieved Tarball
    High · 7.5 CVE-2023-30620 < 23.2.1.0 23.2.1.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.