CVE-2026-58198 Details
Description
ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract() uses a predictable home-rooted output directory (~/ubuntu_data/ubuntu_dialogs) with a check-then-create pattern followed by tar.extractall(path=self.data_path), allowing a local attacker who pre-plants a symlink at the predictable path to cause archive contents to be written through the symlink to an attacker-chosen directory. This issue is fixed in version 1.2.14.
A vulnerability in ChatterBot's UbuntuCorpusTrainer prior to version 1.2.14 allows local attackers to exploit a predictable output directory used during tar file extraction. The issue arises because the extraction method does not properly validate whether the output directory is a symlink. Attackers can pre-plant a symlink to redirect extracted files to an arbitrary location, potentially leading to unauthorized file manipulation or overwriting.
Users can upgrade to ChatterBot version 1.2.14 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-wvrh-2f4m-924v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/gunthercox/ChatterBot/commit/82817b5c28bfd43e682b991bcc76e6f780726dbf | [email protected] | Source CodeVendor |
| https://github.com/gunthercox/ChatterBot/pull/2445 | [email protected] | Issue TrackingVendor |
| https://github.com/gunthercox/ChatterBot/releases/tag/1.2.14 | [email protected] | Release NotesVendor |
| https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-wvrh-2f4m-924v | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ChatterBot | <= 1.2.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |