Complete Guide to CVE-2025-68472 - MindsDB has improper sanitation of filepath that leads to information disclosure...

CVE ID : CVE-2025-68472 Published : Jan. 12, 2026, 5:15 p.m. | 1 hour, 27 minutes ago Description : MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. The PUT handler in file.py directly joins user-controlled data into a filesystem path when the request body is JSON and source_type is not

Source: Telegram CVE Monitor