# CVE-2022-23522: Arbitrary file write in mindsdb when Extracting Tarballs retrieved from a remote location

Source: https://junglewise.ai/threats/cve-2022-23522-arbitrary-file-write-in-mindsdb-when-extracting-tarballs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-03-30  
License: CC BY 4.0 with a link back

CVE-2022-23522 · Severity: low · CVSS 3.1 · Published 2023-03-30

MindsDB is an open source machine learning platform. An unsafe extraction is being performed using `shutil.unpack_archive()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. This vulnerability is sometimes called a **TarSlip** or a **ZipSlip variant**. Unpacking files using the high-level function `shutil.unpack_archive()` from a potentially malicious tarball without validating that the destination file path remained within the intended destination directory may cause files to be overwritten outside the destination directory. An attacker could craft a malicious tarball with a filename path, such as `../../../../../../../../etc/passwd`, and then serve the archive remotely using a personal bucket `s3`, thus, retrieve the tarball through **mindsdb** and overwrite the system files of the hosting server. This issue has been addressed in version 22.11.4.3. Users are advised to upgrade. Users unable to upgrade should avoid ingesting archives from untrusted sources.

Technologies: [mindsdb (PyPI)](https://junglewise.ai/threats/technologies/mindsdb). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-23522 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-23522 being exploited in the wild.

**How severe is CVE-2022-23522?** Low severity, with a CVSS score of 3.1, published 30 March 2023.

**Which products and versions are affected?** mindsdb (PyPI) ECOSYSTEM:introduced=0,fixed=22.11.4.3.

**Is there a fix for CVE-2022-23522?** Yes. mindsdb (PyPI): upgrade to 22.11.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2022-23522?** Check whether you run mindsdb (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mindsdb (PyPI): upgrade to 22.11.4.3 or later

  ```sh
  pip install "mindsdb>=22.11.4.3"
  ```


## Affected products

- mindsdb (PyPI) ECOSYSTEM:introduced=0,fixed=22.11.4.3

## Identifiers

- CVE-2022-23522
- GHSA-7x45-phmr-9wqp
- PYSEC-2023-26

## Related threats

- [PYSEC-2026-2648 - MindsDB has an Improper Access Control Issue](https://junglewise.ai/threats/cve-2026-7711-mindsdb-has-an-improper-access-control-issue)
- [PYSEC-2026-1628 - MindsDB Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2024-45856-mindsdb-cross-site-scripting-in-web-ui)
- [PYSEC-2026-1629 - MindsDB Eval Injection vulnerability](https://junglewise.ai/threats/cve-2024-45847-mindsdb-eval-injection-vulnerability)
- [MindsDB path traversal in /api/files leading to RCE](https://junglewise.ai/threats/cve-2026-27483-mindsdb-path-traversal-in-api-files-leading-to-rce)
- [MindsDB SSRF via URL validation bypass in File Upload](https://junglewise.ai/threats/cve-2026-2531-mindsdb-ssrf-via-url-validation-bypass-in-file-upload)