CVE-2026-109155: DeepPavlov Model Download untar path traversal
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using DeepPavlov version 1.7.0 or earlier are affected where the Model Download Handler's untar function is used. The issue can be exploited remotely.
What access does an attacker need?
The supplied vector indicates network access is sufficient and no privileges are required. Exploitation does require user interaction.
What is the likely impact of successful exploitation?
The vulnerability is a path traversal issue in archive extraction. The provided severity vector indicates low impact to confidentiality, integrity, and availability.
Is a fix available?
The data does not identify a fixed version. It states that the project was notified through an issue report but had not responded at the time of reporting.