CVE-2026-119979
Awaiting Analysis Awaiting Analysis - Queue

LM Studio Path Traversal in Model Downloader

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119979
EUVD
EUVD-2026-114249

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Element Labs LM Studio 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LM Studio before 0.4.22+1 has a path traversal flaw in its model downloader. Attackers can use backslash-separated filenames to write files outside the intended models directory. This allows planting malicious files like manifest.json or Python payloads that execute when LM Studio launches.

Impact Analysis

An attacker could trick you into downloading a malicious model repository. This could lead to arbitrary file writes, execution of attacker-supplied Python code, or installation of unwanted plugins on every application launch. It may compromise system integrity or data.

Compliance Impact

This vulnerability could lead to unauthorized code execution or data access, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Update LM Studio to version 0.4.22 or later to address the path traversal vulnerability in the model downloader.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119979. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart