Detections
Analytics

SCA: security update for MindsDB (GHSA-qqhf-pm3j-96g7)

critical Tenable Cloud Security Plugin ID 436694

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1,
 an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the
 server filesystem and move them into MindsDB’s storage, exposing sensitive data. The PUT handler in
 file.py directly joins user-controlled data into a filesystem path when the request body is JSON and
 source_type is not "url". Only multipart uploads and URL-sourced uploads receive sanitization; JSON
 uploads lack any call to clear_filename or equivalent checks. This vulnerability is fixed in 25.11.1.
 (CVE-2025-68472)

Solution

Update the MindsDB library and its related packages to version 25.11.1 or later.

See Also

https://github.com/advisories/GHSA-qqhf-pm3j-96g7

Plugin Details

Severity: Critical

ID: 436694

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 1/12/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.59

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2025-68472

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/12/2026

Vulnerability Publication Date: 1/12/2026

Reference Information

CVE: CVE-2025-68472