A critical path traversal vulnerability in MindsDB versions prior to 25.11.1 allows unauthenticated attackers to access and manipulate sensitive files on the host server.

This is a path traversal vulnerability (CWE-22, CWE-23, CWE-36) occurring in the file upload API, specifically within the PUT handler in file.py. Unauthenticated attackers can leverage insufficient input sanitization in JSON-based upload requests to bypass directory restrictions and access arbitrary files.

The ability for an unauthenticated user to read arbitrary system files presents a severe risk of data exfiltration and credential theft. Furthermore, the capacity to move files into storage locations could facilitate remote code execution or system compromise. With a CVSS score of 8.1, this vulnerability represents a high-severity threat that could lead to full system takeover or significant exposure of proprietary enterprise data.

Immediate Action: Update MindsDB to version 25.11.1 or later to implement the necessary filename sanitization checks within the file upload API.

Proactive Monitoring: Inspect server access logs for anomalous PUT requests directed at the file upload endpoint, particularly those involving unusual path characters or unexpected file extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing path traversal sequences (such as "../") targeted at the MindsDB API endpoints.

Public Exploit Available: Unknown

Given the exposure of the file upload API to unauthenticated actors and the existence of proof-of-concept evidence, this vulnerability poses an immediate danger to the integrity and confidentiality of the host environment. Administrators must prioritize the upgrade to version 25.11.1 immediately to eliminate the underlying flaw and prevent potential unauthorized system access.