High severity · published Feb 16, 2026
CVE-2026-2531
MindsDB File Upload security.py clear_filename server-side request forgery
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 74d6f0fd4b630218519a700fbee1c05c7fd4b1ed. It is best practice to apply a patch to resolve this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
MindsDB · Mindsdb
25.14.0; 25.14.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2531
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2531
Product
https://github.com/mindsdb/mindsdb/
Exploit
https://github.com/mindsdb/mindsdb/issues/12163
Issue Tracking
https://github.com/mindsdb/mindsdb/pull/12213
Patch
https://github.com/themavik/mindsdb/commit/74d6f0fd4b630218519a700fbee1c05c7fd4b1ed
Permissions Required
https://vuldb.com/?ctiid.346119
Third Party Advisory
https://vuldb.com/?id.346119
More from MindsDB
9.1
CVE-2025-68472
MindsDB is a platform for building artificial intelligence from enterprise data
9.1
CVE-2024-24759
MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
9.1
CVE-2023-50731
MindsDB is a SQL Server for artificial intelligence
8.8
CVE-2026-92207
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
8.8
CVE-2026-27483
MindsDB has Path Traversal in /api/files Leading to Remote Code Execution