CVE-2026-109155
Received Received - Intake

Path Traversal in DeepPavlov Model Download Handler

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109155
EUVD
EUVD-2026-98451

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
n/a DeepPavlov 1.0
n/a DeepPavlov 1.1
n/a DeepPavlov 1.2
n/a DeepPavlov 1.3
n/a DeepPavlov 1.4
n/a DeepPavlov 1.5
n/a DeepPavlov 1.6
n/a DeepPavlov 1.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in DeepPavlov versions up to 1.7.0. It exists in the Model Download Handler's untar function, allowing remote attackers to manipulate file paths and access unauthorized directories. The project was notified but has not responded yet.

Detection Guidance

To detect this vulnerability, check if DeepPavlov versions up to 1.7.0 are installed. Inspect logs for unusual file operations or path traversal attempts during model downloads. Monitor network traffic for unexpected outbound connections to untrusted sources.

Impact Analysis

If exploited, this vulnerability could allow attackers to read or write files outside intended directories, potentially leading to data theft, code execution, or system compromise. It may also enable unauthorized access to sensitive files or configuration data.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations and potential penalties.

Mitigation Strategies

Update DeepPavlov to the latest version beyond 1.7.0 if available. Monitor network traffic for unusual file operations or path traversal attempts. Disable the Model Download Handler component if not essential. Restrict network access to DeepPavlov instances to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109155. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart