CVE-2026-2531: MindsDB File Upload security.py clear_filename server-side request forgery
A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clearfilename of the file mindsdb/utilities/security.py of the component File Upload. Such manipulation leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2531?
CVE-2026-2531 is classified as a high-severity vulnerability that allows for security risks related to server-side request forgery.
How do I fix CVE-2026-2531?
To fix CVE-2026-2531, update MindsDB to a version later than 25.14.1 where the vulnerability has been addressed.
What components are affected by CVE-2026-2531?
CVE-2026-2531 affects the clear_filename function within the security.py file of the MindsDB component.
Can CVE-2026-2531 be exploited remotely?
Yes, CVE-2026-2531 can be exploited remotely due to its nature of being related to file upload functionalities.
What type of attacks can be conducted using CVE-2026-2531?
CVE-2026-2531 can lead to server-side request forgery attacks, which may allow an attacker to make unauthorized requests to internal systems.