CVE-2026-109153
Received Received - Intake

Path Traversal in MosaicML Composer

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109153
EUVD
EUVD-2026-98450

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
MosaicML Composer 0.32.0
MosaicML Composer 0.32.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in MosaicML Composer up to version 0.32.1. It exists in the tarball.extractall function within composer/utils/checkpoint.py, specifically in the Checkpoint Extraction component. An attacker can remotely exploit this to access unauthorized files on the system by manipulating file paths during extraction.

Detection Guidance

To detect this path traversal vulnerability in MosaicML Composer, inspect the tarball.extractall function in composer/utils/checkpoint.py for improper path handling. Check for any user-controlled input being passed directly to extractall without validation. Review logs for unusual file access patterns or attempts to write outside intended directories.

Impact Analysis

This vulnerability could allow attackers to read sensitive files on the system where Composer is running. If exploited, it may lead to unauthorized data access, potential data breaches, or further system compromise depending on the extracted files' contents.

Compliance Impact

The vulnerability allows path traversal via tarball.extractall in MosaicML Composer, which could lead to unauthorized file access or modification. This may impact compliance with GDPR by risking data integrity and confidentiality, and with HIPAA by potentially exposing protected health information if exploited.

Mitigation Strategies

Update MosaicML Composer to the latest version beyond 0.32.1 to address the path traversal vulnerability in tarball.extractall. If immediate update is not possible, restrict access to the Checkpoint Extraction component and monitor for unusual file access patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109153. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart