CVE-2026-109153

EUVD-2026-98450
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 40.8%
Common Weakness Enumeration
References
https://github.com/mosaicml/composer/
https://github.com/mosaicml/composer/issues/3942
https://vuldb.com/cve/CVE-2026-109153
https://vuldb.com/submit/978647
https://vuldb.com/vuln/416887
https://vuldb.com/vuln/416887/cti