GHSA-6xw9-2p64-7622

MindsDB affected by a SSRF vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2026-2531

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	MindsDB	<= 25.14.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-2531 advisory
https://github.com/mindsdb/mindsdb/issues/12163 web
https://github.com/mindsdb/mindsdb/pull/12213 web
https://github.com/themavik/mindsdb/commit/74d6f0fd4b630218519a700fbee1c05c7fd4b1ed web
https://github.com/mindsdb/mindsdb package
https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2026-91.yaml web
https://vuldb.com/?ctiid.346119 web
https://vuldb.com/?id.346119 web
https://vuldb.com/?submit.748219 web