漏洞描述
MindsDB < 25.9.1.1 contains a remote code execution caused by path traversal in the /api/files upload file module, letting authenticated attackers write arbitrary files and execute commands, exploit requires authentication.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfq↗github.comhttps://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505ef↗github.comhttps://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-27483↗