Path Traversal Vulnerability in MindsDB File Upload API

CVE-2025-68472

What is CVE-2025-68472?

MindsDB has a vulnerability within its file upload API that allows unauthenticated users to exploit a path traversal weakness. This issue enables attackers to read arbitrary files from the server filesystem and transfer them to MindsDB's storage, potentially exposing sensitive data. Specifically, versions prior to 25.11.1 fail to properly sanitize JSON uploads, leaving the system vulnerable to such attacks. While multipart uploads and URL-based uploads receive appropriate sanitization, JSON uploads do not trigger necessary security checks, increasing the risk of data breaches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References