HighVulnerability
CVE-2022-23522: MindsDB path traversal in archive extraction via remotely retrieved tarball
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2022-23522
- Published
- Record updated
- Affected
- mindsdb < 22.11.4.3
- Fixed in
- 22.11.4.3
- released December 9, 2022, 111 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.9%
Summary
MindsDB, an open source machine learning platform, unpacks remotely retrieved tarballs with `shutil.unpack_archive()` without checking that extracted paths stay inside the destination directory. A crafted archive containing traversal filenames such as `../../etc/passwd` can therefore overwrite files outside that directory, including system files on the hosting server.
Mitigation
This issue has been addressed in version 22.11.4.3. Users are advised to upgrade. Users unable to upgrade should avoid ingesting archives from untrusted sources.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online