CVE-2025-68472: Path Traversal in MindsDB

The primary impact of this vulnerability is the potential for unauthorized access to sensitive data stored on the server. An attacker can exploit this flaw to read configuration files, database credentials, or other confidential information. Furthermore, the ability to move files into MindsDB’s storage could allow an attacker to overwrite existing data or introduce malicious files, potentially leading to data corruption or further compromise of the system. This vulnerability resembles other path traversal exploits where attackers leverage predictable file system structures to bypass access controls.

1. Reserved2025-12-18
2. Published2026-01-12
3. Modified2026-02-22
4. EPSS updated2026-03-23

The recommended mitigation is to immediately upgrade MindsDB to version 25.11.1 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting network access to the file upload API or implementing stricter input validation to prevent malicious path manipulation. Review and audit file upload processes to ensure proper sanitization of user-supplied data. After upgrading, confirm the fix by attempting a path traversal attack via the file upload API and verifying that access is denied.