# CVE-2026-104103: Ludwig path traversal in archive extraction

Source: https://junglewise.ai/threats/cve-2026-104103-ludwig-is-a-low-code-framework-for-building-custom-llms-neural  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-104103 · Severity: high · CVSS 8.1 · Published 2026-10-14

Ludwig is a low-code framework for building custom machine learning and AI models. A flaw in its archive extraction code could allow an attacker to write files to arbitrary locations on the system when a user processes a malicious tar archive. This could lead to arbitrary code execution or system compromise if an attacker controls the archive source.

Technologies: [Ludwig AI Ludwig](https://junglewise.ai/threats/technologies/ludwig). Vendors: [Ludwig AI](https://junglewise.ai/threats/vendors/ludwig-ai).

## Quick answers

**Is CVE-2026-104103 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104103 being exploited in the wild.

**How severe is CVE-2026-104103?** High severity, with a CVSS score of 8.1, published 14 October 2026.

**Which products and versions are affected?** Ludwig AI Ludwig before 0.17.8.

**Is there a fix for CVE-2026-104103?** Yes: fixed in 0.17.8. Until then: Avoid processing tar archives from untrusted or attacker-controlled sources. If upgrading is not immediately possible, restrict archive extraction to trusted archive sources only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104103 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104103?** Check whether you run Ludwig AI Ludwig at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.17.8

Avoid processing tar archives from untrusted or attacker-controlled sources. If upgrading is not immediately possible, restrict archive extraction to trusted archive sources only.

## Technical details

The vulnerability is a path traversal in ludwig.datasets.archives.extract_archive() that validates tar member names but fails to validate symlink and hardlink targets before extraction. An attacker can craft a tar archive with a symlink pointing outside the destination directory, followed by a regular file that resolves through that link, bypassing the containment check. Additionally, the original validation used os.path.commonprefix (character-based comparison) rather than os.path.commonpath (component-based), allowing sibling paths like "/data/dest-evil" to bypass checks for "/data/dest".

## Affected products

- Ludwig AI Ludwig before 0.17.8

## Timeline

- 2026-10-14: disclosed
- 2026-07-26: patched: Fix committed before public disclosure

## References

- [https://github.com/ludwig-ai/ludwig/commit/7f534f31e725cc5362c8f6f85537488443de279a](https://github.com/ludwig-ai/ludwig/commit/7f534f31e725cc5362c8f6f85537488443de279a)
- [https://github.com/ludwig-ai/ludwig/releases/tag/v0.17.8](https://github.com/ludwig-ai/ludwig/releases/tag/v0.17.8)

## Related threats

- [Ludwig insecure deserialization in model serving component](https://junglewise.ai/threats/cve-2026-31238-ludwig-insecure-deserialization-in-model-serving-component)
- [Ludwig AI framework insecure deserialization in predict method](https://junglewise.ai/threats/cve-2026-31237-ludwig-ai-framework-insecure-deserialization-in-predict-method)