CVE-2026-43637
Deferred Deferred - Pending Action

Path Traversal in Cornac via Malicious TAR Archive

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: VulnCheck

Description
Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loaders, which automatically download and extract archives, causing archive.extractall() to write files to arbitrary locations on the filesystem accessible to the running process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-08-05
AI Q&A
2026-07-15
EPSS Evaluated
2026-08-03
NVD
CVE-2026-43637
EUVD
EUVD-2026-44669

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
preferredai cornac to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal (Tar Slip) vulnerability in Cornac versions before 2.6.0. It allows attackers to write arbitrary files outside the intended cache directory by providing a maliciously crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries. The vulnerability is triggered through built-in dataset loaders that automatically download and extract archives.

Detection Guidance

To detect this vulnerability, inspect Cornac installations for versions before 2.6.0. Check for unexpected files in system directories or cache locations. Monitor network traffic for suspicious archive downloads via built-in dataset loaders. Use file integrity monitoring tools to detect unauthorized file writes.

Impact Analysis

An attacker could exploit this to write malicious files to arbitrary locations on your filesystem accessible by the running process. This could lead to code execution, data theft, or system compromise depending on the permissions of the affected process.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. Organizations using affected versions may face compliance violations if sensitive data is exposed or altered.

Mitigation Strategies

Upgrade Cornac to version 2.6.0 or later immediately. Remove or restrict write permissions for Cornac cache directories. Review and validate all dataset archives before extraction. Replace insecure HTTP URLs with HTTPS in dataset configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43637. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart