CVE-2026-108940

Received Received - Intake

Path Traversal in Mistral.rs Server

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulDB

Description

A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108940

EUVD

EUVD-2026-98169

Affected Vendors & Products

Vendor	Product	Version / Range
EricLBuehler	Mistral.rs	0.9.0
EricLBuehler	Mistral.rs	0.9.1
EricLBuehler	Mistral.rs	0.9.2
EricLBuehler	Mistral.rs	0.9.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in EricLBuehler Mistral.rs up to version 0.9.3. The function calibration_apply in mistralrs-server-core/src/handlers.rs improperly handles the save_cimatrix argument, allowing attackers to manipulate file paths and access unauthorized directories remotely.

Detection Guidance

To detect this vulnerability, check if your mistral.rs server is running a version prior to 0.9.4. Use commands like 'curl -s https://github.com/EricLBuehler/mistral.rs/releases/tag/v0.9.4' to verify the installed version. Inspect server logs for path traversal attempts in calibration requests involving the save_cimatrix parameter.

Impact Analysis

An attacker could exploit this to read or write files outside intended directories, potentially stealing sensitive data, modifying system files, or executing arbitrary code on the server. The exploit is remotely accessible and has been publicly disclosed.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Upgrade mistral.rs to version 0.9.4 or later to address the path traversal vulnerability in the save_cimatrix function. The fix restricts the parameter to accept only bare file names without directory traversal sequences.

Hi! I’m here to help you understand CVE-2026-108940. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70