AVID-2026-R1237

Description

Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb (CVE-2023-30620)

Details

mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using tarfile.extractall() from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release 23.2.1.0 . Users are advised to upgrade. There are no known workarounds for this vulnerability.

Reason for inclusion in AVID: CVE-2023-30620 affects MindsDB, an AI platform. It describes unsafe extraction from a remotely retrieved tarball via tarfile.extractall(), enabling arbitrary file write (path traversal). This is a software vulnerability in an AI product used in AI pipelines, impacting the software supply chain for general-purpose AI systems. The CVE provides explicit details and a fixed release, satisfying evidence for AVCID curation.

References

Affected or Relevant Artifacts

Developer: mindsdb
Deployer: mindsdb
Artifact Details:

Type	Name
System	mindsdb

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score	7.5
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	🔴 High
Availability Impact	NONE

CWE

ID	Description
CWE-22	CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2023-04-21
Version: 0.3.3
AVID Entry