CVE-2026-27483

CVE-2026-27483 is a high-severity path traversal vulnerability affecting MindsDB prior to version 25.9.1.1. An authenticated attacker can exploit this flaw in the /api/files interface by manipulating filenames during file uploads, leading to arbitrary file writes and ultimately remote command execution. With a CVSS score of 8.8, this vulnerability is easily exploitable over the network with low complexity and user privileges, allowing for complete compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation or public exploit code, but the vulnerability has garnered some community discussion.