CVE-2026-109153
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.
Risk Assessment
An attacker can write files outside the target directory during checkpoint extraction, potentially leading to file overwrite or code execution on the server.
Recommendation
Validate paths in tarball.extractall and restrict checkpoint extraction to a safe directory; update to a fixed version when available.
Other vulnerabilities in MosaicML Composer
Original NVD description (English source)
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS