https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T20:06:26.791833+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-10297 EUVD-2026-10297 2026-10-20T20:06:26.828962+00:00 EUVD-2026-10297 https://cve.radiocsirt.org/vuln/fkie_cve-2023-49796 fkie_cve-2023-49796 2026-10-20T20:06:26.829005+00:00

MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in `file.py` Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-crhp-7c74-cg4c GHSA-crhp-7c74-cg4c — Improper Input Validation in mindsdb 2026-10-20T20:06:26.829041+00:00

Affected: PyPI: mindsdb

### Impact

The put method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled `name` value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. This issue may lead to arbitrary file write. This vulnerability allows for writing files anywhere on the server that the filesystem permissions that the running server has access to.

### Patches

Use mindsdb staging branch or v23.11.4.1

### References

* GHSL-2023-184 * See [CodeQL path injection prevention guidelines](https://codeql.github.com/codeql-query-help/python/py-path-injection/) and [OWASP guidelines](https://owasp.org/www-community/attacks/Path_Traversal).

 https://cve.radiocsirt.org/vuln/gsd-2023-49796 gsd-2023-49796 2026-10-20T20:06:26.829119+00:00 gsd-2023-49796 https://cve.radiocsirt.org/vuln/pysec-2023-278 Withdrawn: PYSEC-2023-278 2026-10-20T20:06:26.829163+00:00

Withdrawn by the publisher.

Affected: PyPI: mindsdb

MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in `file.py` Users should use MindsDB's `staging` branch or v23.11.4.1, which contain a fix for the issue.