CVE-2025-68472 is a high severity path traversal (CVSS 8.1) in MindsDB. Before 25.11.1, an unauthenticated caller of the file upload API could read arbitrary files from the server and move them into MindsDB storage. Upgrade to MindsDB 25.11.1 or later and keep the API off untrusted networks.
What's affected
- MindsDB before 25.11.1.
- Fixed version: 25.11.1.
- The flaw is in the PUT handler in file.py, when the request body is JSON and source_type is not url.
How to check if you're exposed
Check the installed version:
pip show mindsdb
For a container, check the image tag. Any version below 25.11.1 is affected. Then check who can reach the API. The CVSS vector says adjacent network, so a MindsDB service on an internal network that many hosts can reach is the main concern, and one on the public internet is worse.
You can also paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. It lists known CVEs for the versions it finds and runs in your browser.
What to do now
- Find every MindsDB deployment, including notebooks and test servers.
- Upgrade to 25.11.1 or later with
pip install -U mindsdb, or pull a fixed image. - Restrict network access to the MindsDB API to the clients that need it.
- Review the MindsDB storage folder for files you did not upload, which may be copies of server files.
- Rotate any secrets stored on the host if you find signs of misuse.
Why it matters
The record lists CWE-22, CWE-23 and CWE-36, the path traversal family. User supplied data was joined straight into a file system path. Two of the three upload paths cleaned the file name. The JSON path did not call the cleaning function, so it was left open.
This is a common pattern: one route is hardened and a sibling route that does the same job is missed. The practical lesson is to test every input path to a file operation, not only the main one.
An AI data platform often holds connection strings and keys for the databases it queries, so a file read here can lead further. The record does not list this CVE as exploited in the wild.
If you use MindsDB, think about what the host can reach. A process that can read any file on the machine, and that stores connection details for databases, is a good place for an attacker to look for secrets. Run it as an unprivileged user, in a container with only the volumes it needs mounted, and keep secrets in a store rather than on the file system.
Network placement matters too. The vector is adjacent network, which means exposure inside a shared network, such as a lab, a coworking space or a flat office network. Moving the service to a private segment, or behind a proxy that adds authentication, closes that path.
Last, add file upload and file path handlers to your code review checklist. The pattern in this advisory, where two routes were checked and one was missed, appears in many projects.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the MindsDB flaw affect URL sourced uploads?
The advisory says multipart and URL sourced uploads were sanitized. The gap was in JSON uploads where source_type is not url.
Sources
Last reviewed: 19 October 2026.
