CVE-2026-109155

EUVD-2026-98451
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 32.8%
Common Weakness Enumeration
References
https://github.com/deeppavlov/DeepPavlov/
https://github.com/deeppavlov/DeepPavlov/issues/1711
https://vuldb.com/cve/CVE-2026-109155
https://vuldb.com/submit/978673
https://vuldb.com/vuln/416888
https://vuldb.com/vuln/416888/cti