Path Traversal Vulnerability in UbiquitousLearning mllm Product
CVE-2026-115800

4.8MEDIUM

Key Information:

Vendor: Ubiquitouslearning
Status: Mllm
Vendor: CVE Published:; 23 October 2026

🔔 Create Ubiquitouslearning Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-115800?

A path traversal vulnerability exists in the load_model function of the Convertor component in UbiquitousLearning's mllm, affecting versions up to 2.0.2. An attacker can exploit this vulnerability by manipulating the shard_file argument to access unauthorized files on the file system. This issue has been flagged through an issue report, but the response from the project has been lacking, leaving a potential target for local attackers. Exploits targeting this vulnerability have surfaced, making it essential for users to review security measures and apply updates if necessary.

Affected Version(s)

mllm 2.0.0

mllm 2.0.1

mllm 2.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-115800 - Proof of Concept