CVE-2026-109155

Publié : 13 octobre 2026

Modifié : 13 octobre 2026

Score CVSS

6.3

MEDIUM

Description détaillée

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/deeppavlov/DeepPavlov/https://github.com/deeppavlov/DeepPavlov/issues/1711 https://vuldb.com/cve/CVE-2026-109155 https://vuldb.com/submit/978673 https://vuldb.com/vuln/416888 https://vuldb.com/vuln/416888/cti

Dernières Vulnérabilités

CVE-2026-94410

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

VOIR DÉTAILS

CVE-2026-89279

Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects authtake: from v1.3 before v1.4.

VOIR DÉTAILS

CVE-2026-63316

A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34.

VOIR DÉTAILS