This vulnerability in MindsDB up to version 26.01 involves the exec function within the Engine Handler component, specifically in the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py. An attacker can remotely manipulate this function to upload files without restriction. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.9, indicating network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. No official remediation or patch has been provided by the vendor despite early notification. Public exploit code is available, which could facilitate attacks.

Successful exploitation allows remote attackers to upload arbitrary files to the affected MindsDB system without restriction. This could lead to unauthorized code execution or other malicious activities depending on the uploaded content and system configuration. The vulnerability impacts confidentiality, integrity, and availability to a limited degree as per the CVSS vector. The presence of public exploit code increases the likelihood of attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing compensating controls such as restricting network access to the vulnerable component, monitoring for suspicious file uploads, and isolating affected systems until a patch or official guidance is released.