CVE-2026-115800 Details
Description
A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
A path traversal vulnerability has been identified in UbiquitousLearning MLLM versions through 2.0.2. The issue arises in the 'load_model' function within 'pymllm/mobile/convertor/__init__.py', where the 'shard_file' argument is manipulated, allowing for traversal outside the intended directory. This vulnerability can be exploited locally by crafting a model package that directs the loader to read files from outside its package, potentially leading to unauthorized access to the filesystem.
The vulnerability can be addressed by modifying the 'load_model' function to reject shard filenames that escape the model package or resolve outside of it. Implementing containment checks after joining paths and adding a regression test for the vulnerability would also be effective.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/UbiquitousLearning/mllm/ | [email protected] | Source CodeVendor |
| https://github.com/UbiquitousLearning/mllm/issues/711 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/user-attachments/files/33258553/poc.zip | [email protected] | Broken LinkExploit |
| https://vuldb.com/cve/CVE-2026-115800 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1022230 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/425982 | [email protected] | Content Wall |
| https://vuldb.com/vuln/425982/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| UbiquitousLearning mllm | <= 2.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |