Path Traversal Vulnerability in DeepPavlov Model Download Handler up to Version 1.7.0

CVE-2026-109155

What is CVE-2026-109155?

A vulnerability has been identified in DeepPavlov affecting versions up to 1.7.0, specifically within the Model Download Handler's untar function. This flaw allows an attacker to exploit path traversal, enabling unauthorized access to system files. The vulnerability can be exploited remotely, raising significant security concerns. Despite early reports to the DeepPavlov team, no official response has been issued regarding this critical issue.

References