The flaw resides in the exec function of proc_wrapper.py in MindsDB’s Engine Handler, allowing an attacker to upload any file type without restriction. This weakness can be triggered remotely, enabling the delivery of potentially malicious payloads that the system may later execute or use to compromise stability and confidentiality.

All MindsDB installations up to and including version 26.01 are affected. No vendor patch has been publicly released yet; the issue remains in the Engine Handler component that handles BYOM requests.

The CVSS score of 6.9 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. No EPSS value is available, but the presence of a publicly available exploit and the ability to launch the attack remotely raise the risk profile. Attackers could exploit the unrestricted upload to introduce executable files, potentially leading to remote code execution or other abuse of system privileges.