CVE-2026-109155
MediumCVSS 6.3Summary
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Risk Assessment
An attacker can write or read files outside the target directory during model extraction, potentially leading to file overwrite or code execution.
Recommendation
Validate paths during model archive extraction and restrict writes to a safe directory; consider applying your own fix, as the project has not responded.
Other vulnerabilities in DeepPavlov
See all- CVE-2026-112100Medium
A vulnerability was determined in DeepPavlov up to 1.7.0 affecting the MultiTaskPipelinePreprocessor.__init__ function in deeppavlov/models/preprocessors/multitask_preprocessor.py. Manipulating the preprocessor argument causes code injection, and the attack can be carried out remotely. The exploit has been publicly disclosed and the project has not yet responded to the issue report.
- CVE-2026-112098Medium
A security flaw was discovered in DeepPavlov up to 1.7.0 affecting the resolve function in deeppavlov/core/common/params.py within the Config Reference Resolver component. Manipulation leads to code injection, and the attack can be launched remotely. The exploit has been released publicly and the project has not yet responded to the issue report.
Original NVD description (English source)
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS