Is CVE-2026-108940 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108940 being exploited in the wild.

How severe is CVE-2026-108940?

Medium severity, with a CVSS score of 6.5, published 13 October 2026.

Which products and versions are affected?

EricLBuehler Mistral.Rs up to 0.9.3.

Is there a fix for CVE-2026-108940?

Yes: fixed in 0.9.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108940 attacked?

It is attacked over the network.

Am I affected by CVE-2026-108940?

Check whether you run EricLBuehler Mistral.Rs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108940: EricLBuehler Mistral.rs path traversal in calibration_apply

CVE-2026-108940 · Severity: medium · CVSS 6.5 · Published 2026-10-13

Mistral.rs is a Rust-based inference engine for large language models. An attacker can exploit a path traversal vulnerability in the calibration feature by manipulating a file path parameter, potentially allowing unauthorized file access or modification on the server. The vulnerability can be triggered remotely without authentication.

Technologies: EricLBuehler Mistral.Rs. Vendors: EricLBuehler.

Quick answers

Is CVE-2026-108940 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108940 being exploited in the wild.
How severe is CVE-2026-108940?: Medium severity, with a CVSS score of 6.5, published 13 October 2026.
Which products and versions are affected?: EricLBuehler Mistral.Rs up to 0.9.3.
Is there a fix for CVE-2026-108940?: Yes: fixed in 0.9.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108940 attacked?: It is attacked over the network.
Am I affected by CVE-2026-108940?: Check whether you run EricLBuehler Mistral.Rs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.9.4

Technical details

A path traversal flaw exists in the calibration_apply function within mistralrs-server-core/src/handlers.rs, where insufficient input validation on the save_cimatrix parameter allows directory traversal sequences (e.g., "../"). An attacker can remotely send a crafted request with path traversal characters to access or write files outside the intended calibration directory. The fix restricts the parameter to accept only bare filenames, blocking traversal attempts.

Affected products

EricLBuehler Mistral.rs up to 0.9.3

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.