CVE-2026-27483.

Disclosure summary

### Summary There is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. ### Details The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. The affected code is located at mindsdb/api/http/namespaces/file.py: ```python @ns_conf.route("/") @ns_conf.param("name", "MindsDB's name for file") class File(Resource): @ns_conf.doc("put_file") @api_endpoint_metrics('PUT', '/files/file') def put(self, name: str): """add new file params in FormData: - file - original_file_name [optional] """ data = {} mindsdb_file_name = name existing_file_names = ca.file_controller.get_files_names() def on_field(field): name = field.field_name.decode() value = field.value.decode() data[name] = value file_object = None def on_file(file): nonlocal file_object data["file"] = file.file_name.decode() file_object = file.file_object temp_dir_path = tempfile.mkdtemp(prefix="mindsdb_file_") if request.headers["Content-Type"].startswith("multipart/form-data"): parser = multipart.create_form_parser( headers=request.headers, on_field=on_field, on_file=on_file, config={ "UPLOAD_DI

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

Original records & references

• NIST NVD record
• CVE Program record
• github.com — Reviewed advisory

PUBLISHED 2026-02-24T15:07:58-05:00
MODIFIED 2026-10-08T09:45:16-04:00
INGESTED 2026-10-08T12:30:44-04:00