Path Traversal Vulnerability in MosaicML Composer by MosaicML
CVE-2026-109153

5.3MEDIUM

Key Information:

Vendor

Mosaicml

Status
Composer
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109153?

A path traversal vulnerability was identified in MosaicML Composer up to version 0.32.1, specifically affecting the tarball.extractall function within the checkpoint extraction module found in composer/utils/checkpoint.py. This flaw enables an attacker to manipulate file paths, potentially leading to unauthorized access to restricted files. The vulnerability can be exploited remotely, which raises significant security concerns for applications utilizing this component. Early disclosure communication was made with the vendor regarding this issue.

Affected Version(s)

Composer 0.32.0

Composer 0.32.1

References

https://vuldb.com/vuln/416887
vdb-entrytechnical-description
https://vuldb.com/vuln/416887/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-109153
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohammedix88 (VulDB User)
VulDB CNA Team
.