CVE-2026-109155

MediumCVSS 6.3/10Last modified Oct 13, 2026

Description

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
n/aDeepPavlov1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7.0

References

Timeline

Published
Oct 13, 2026
Last modified
Oct 13, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1091566.3A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the coCVE-2026-1091579.9A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/CVE-2026-109166.1Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromisedCVE-2026-1091604.3A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the fCVE-2026-1091614.9Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial of service.CVE-2026-1091626.3Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder CVE-2026-109163Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP SCVE-2026-1091647.1TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other useCVE-2026-1091654.3TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' fCVE-2026-1091666.5lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs CVE-2026-1091674.3TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticaCVE-2026-1091686.5lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business