CVE-2023-30620highCWE-22

CVE-2023-30620: fallo de gravedad alta en mindsdb

Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear mindsdb+ Monitorear mindsdb

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 1.0%
mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release `23.2.1.0 `. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
mindsdb · mindsdb
CVEs relacionadas — mindsdb

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-68472HIGHMindsDB has improper sanitation of filepath that leads to information disclosure and DOSEPSS 20.3%CVE-2026-27483HIGHMindsDB has Path Traversal in /api/files Leading to Remote Code ExecutionEPSS 11.0%CVE-2024-24759CRITICALMindsDB Vulnerable to Bypass of SSRF Protection with DNS RebindingEPSS 4.9%CVE-2024-45846HIGHCVE-2024-45846EPSS 2.1%CVE-2023-50731CRITICALMindsDB has arbitrary file write in file.pyEPSS 1.0%CVE-2022-23522HIGHArbitrary File Write when Extracting Tarballs retrieved from a remote location using in mindsdbEPSS 0.9%