CVE-2026-43637CWE-22

Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py

High · published July 15, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loaders, which automatically download and extract archives, causing archive.extractall() to write files to arbitrary locations on the filesystem accessible to the running process.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00662 · 51.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-15T13:54Z
EPSS history
Timeline
  • 15 JUL 13:54Z
    Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py
    cvelistv5