CVE-2025-68472

MindsDB versions prior to 25.11.1 are vulnerable to an unauthenticated path traversal in the file upload API. The root cause is located in the PUT handler of file.py, which directly joins user-controlled data into a filesystem path when the request body is JSON and source_type is not url. Because...