{"data":{"id":"d163ebab-24eb-4202-9a24-f1166020cf1b","title":"CVE-2022-23522: MindsDB is an open source machine learning platform. An unsafe extraction is being performed using…","summary":"MindsDB, an open source machine learning platform, unpacks remotely retrieved tarballs with `shutil.unpack_archive()` without checking that extracted paths stay inside the destination directory. A crafted archive containing traversal filenames such as `../../etc/passwd` can therefore overwrite files outside that directory, including system files on the hosting server.","solution":"This issue has been addressed in version 22.11.4.3. Users are advised to upgrade. Users unable to upgrade should avoid ingesting archives from untrusted sources.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-23522","publishedAt":"2023-03-30T19:15:06.353Z","cveId":"CVE-2022-23522","cweIds":["CWE-22"],"cvssScore":"8.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mindsdb@< 22.11.4.3 (fixed: 22.11.4.3)"],"affectedPackageNames":["mindsdb"],"affectedPackageRefs":["pypi:mindsdb"],"affectedVendors":[],"affectedVendorsRaw":["MindsDB"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MindsDB path traversal in archive extraction via remotely retrieved tarball","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00883,"epssCheckedAt":"2026-11-04T18:09:13.386Z","kevDateAdded":null,"advisoryAliases":["GHSA-7x45-phmr-9wqp"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:57:03.824Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2022-12-09T21:24:33.493Z","daysToFix":-111,"fixCheckedAt":"2026-10-29T21:47:05.878Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mindsdb","fixedVersion":"22.11.4.3","matchedVersion":"22.11.4.3","fixReleasedAt":"2022-12-09T21:24:33.493Z","daysToFix":-111,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:47:05.726Z"}]}}