This vulnerability in MindsDB up to version 26.01 involves an unrestricted upload flaw in the exec function of the Engine Handler component, specifically in the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py. An attacker can remotely exploit this weakness to upload arbitrary files without restriction. The vulnerability has been publicly disclosed with exploit code available, but the vendor has not provided any response or patch as of the publication date.

Successful exploitation allows remote attackers to upload files without restriction, potentially leading to unauthorized code execution or system compromise. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary controls such as restricting network access to the vulnerable component or disabling the affected functionality until a patch is released.