Path Traversal Vulnerability in EricLBuehler Mistral.rs Product
CVE-2026-108940

6.9MEDIUM

Key Information:

Vendor

Ericlbuehler

Status
Mistral.rs
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108940?

A vulnerability exists in EricLBuehler Mistral.rs, specifically within the function calibration_apply located in the file mistralrs-server-core/src/handlers.rs. Exploiting this vulnerability allows an attacker to perform path traversal by manipulating the argument save_cimatrix. This issue can be exploited remotely, potentially exposing sensitive system files. Users are strongly recommended to upgrade to version 0.9.4, which addresses the vulnerability through a patch identified by commit 8c81056712709b4845ec6d9531e4d35bab4a367c.

Affected Version(s)

Mistral.rs 0.9.0

Mistral.rs 0.9.1

Mistral.rs 0.9.2

References

https://vuldb.com/vuln/416764
vdb-entrytechnical-description
https://vuldb.com/vuln/416764/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108940
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

carfeii (VulDB User)
.