Exploit for Path Traversal in Mindsdb

CVE-2026-27483

githubexploit · 2026-03-06

Description

Path traversal exploit in MindsDB enabling remote code execution; proof of concept.

Entry point

Parameterfname · path

Path/api/files/{fname}

Path traversal in MindsDB /api/files upload allows arbitrary file write via ../ sequences in the filename field, enabling potential remote code execution.

Affected Mindsdb versions

Mindsdb< 25.9.1.1

All known vulnerabilities by product

Mindsdb

CVSS 8.8 for CVE-2026-27483

8.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

72%confidence this exploit runs

Based on 1 file(s) in the source

EPSS Score

11.1%higher than 95.4% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2026-03-06 07:52

Last Seen:2026-03-06 07:58

Reporter:thewhiteh4t

Written in:Python

Last commit:2026-03-07

Other exploits for CVE-2026-27483

cve-2026-27483-lab

2026-09-11 KitPloitKITPLOIT

cve-2026-27483

2026-09-10 KitPloitKITPLOIT

Exploit for Path Traversal in Mindsdb

2026-07-15 nabhan-mohyGITHUB

📄 MindsDB 25.9.1.1 Path Traversal

2026-05-05 Lohitya Pushkar, XlabAITeamPACKETSTORMPython

MindsDB 25.9.1.1 - Path Traversal

2026-05-04 thewhiteh4tEXPLOITDBPython

Exploit Code

README3 lines

## https://sploitus.com/exploit?id=4DB05549-B40B-57CA-B487-DD23FD5D82CE
# cve-2026-27483
MindsDB Path Traversal to RCE PoC

Exploit Code

Share

Share on social media: