MindsDB < 25.9.1.1 - Authenticated Path Traversal and Remote Command Execution via /api/files Upload
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2026-27483. PoCs published by thewhiteh4t, XiaomingX, TreasureBoy520. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability in MindsDB versions prior to 25.9.1.1, leading to remote code execution (RCE) by uploading a malicious Python script via a crafted file upload request and triggering its execution through handler installation.
Description
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. The vulnerability exists in the "Upload File" module, which corresponds to the API endpoint /api/files. Since the multipart file upload does not perform security checks on the uploaded file path, an attacker can perform path traversal by using `../` sequences in the filename field. The file write operation occurs before calling clear_filename and save_file, meaning there is no filtering of filenames or file types, allowing arbitrary content to be written to any path on the server. Version 25.9.1.1 patches the issue.
Exploits (6)
This exploit demonstrates a path traversal vulnerability in MindsDB versions prior to 25.9.1.1, leading to remote code execution (RCE) by uploading a malicious Python script via a crafted file upload request and triggering its execution through handler installation.
This repository contains a functional exploit for CVE-2026-27483, a path traversal vulnerability in MindsDB <= 25.9.1.0 that allows remote code execution by overwriting Python's pip module with a reverse shell payload. The PoC supports both authenticated and unauthenticated modes and includes detailed usage instructions.
This PoC exploits a path traversal vulnerability (CVE-2026-27483) in MindsDB versions 25.4.1.0 to 25.9.1.0, allowing arbitrary file write via unsanitized filename parameters in the `/api/files/` endpoint. The exploit writes a Python reverse shell to the pip `__init__.py` file, achieving RCE when the `anomaly_detection` handler is installed.
This repository provides a complete lab environment to demonstrate CVE-2026-27483, a path traversal RCE vulnerability in MindsDB version 25.9.1.0. The setup includes a vulnerable MindsDB container, attacker workstation with penetration testing tools, and supporting infrastructure (nginx, postgres, backup, etc.) to simulate exploitation.
This repository contains a functional exploit for CVE-2026-27483, a path traversal vulnerability in MindsDB that allows remote code execution by uploading a malicious file to a predictable path and triggering its execution. The PoC includes a Python script and a Nuclei template for detection and exploitation.
This repository contains a functional exploit for CVE-2026-27483, a path traversal vulnerability in MindsDB <= 25.9.1.0 that leads to remote code execution. The PoC uploads a malicious Python file to a predictable path and triggers its execution via handler installation.
Nuclei Templates (1)
http.title:"MindsDB"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H