CVE-2026-109155
6.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-22
Impact
Remote attackers can read or overwrite arbitrary files by tricking a user or service into downloading a malicious tar archive. Exploitation requires user interaction or untrusted model download URLs.
Root cause
The untar function in the Model Download Handler lacks path validation, allowing directory traversal during archive extraction.
Affected systems
DeepPavlov through 1.7.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Fix & remediation
No patched version is available yet as the vendor has not responded. Block untrusted model sources and avoid downloading models from unverified remote URLs.
$ pip show deeppavlovAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.