CVE-2026-43637
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A path traversal (Tar Slip) vulnerability in Cornac before version 2.6.0 allows an attacker to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loaders, which automatically download and extract archives, causing archive.extractall() to write files to arbitrary locations on the filesystem accessible to the running process.
Risk Assessment
The risk involves overwriting or creating files in arbitrary filesystem locations, potentially leading to privilege escalation, execution of malicious code, or permanent system damage.
Recommendation
Immediately update the Cornac library to version 2.6.0 or later, which includes a fix for the Tar Slip vulnerability.
Original NVD description (English source)
Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loaders, which automatically download and extract archives, causing archive.extractall() to write files to arbitrary locations on the filesystem accessible to the running process.