Is CVE-2026-109155 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109155 being exploited in the wild.

How severe is CVE-2026-109155?

Medium severity, with a CVSS score of 6.3, published 13 October 2026.

Is there a fix for CVE-2026-109155?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109155 attacked?

It is attacked over the network.

Am I affected by CVE-2026-109155?

Check whether you run DeepPavlov at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109155: DeepPavlov path traversal in Model Download Handler

CVE-2026-109155 · Severity: medium · CVSS 6.3 · Published 2026-10-13

DeepPavlov is an open-source library for building chatbots and dialogue systems using deep learning. A path traversal vulnerability in its Model Download Handler component allows attackers to extract files to arbitrary locations on a system during model downloads, potentially enabling remote code execution or data theft. The flaw affects versions up to 1.7.0 and requires no authentication.

Technologies: DeepPavlov. Vendors: DeepPavlov.

Quick answers

Is CVE-2026-109155 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109155 being exploited in the wild.
How severe is CVE-2026-109155?: Medium severity, with a CVSS score of 6.3, published 13 October 2026.
Which products and versions are affected?: DeepPavlov up to 1.7.0.
Is there a fix for CVE-2026-109155?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109155 attacked?: It is attacked over the network.
Am I affected by CVE-2026-109155?: Check whether you run DeepPavlov at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the untar function of the Model Download Handler component, which fails to properly sanitize archive file paths during extraction. An attacker can craft a malicious model archive with path traversal sequences (e.g., "../../../") to write files outside the intended directory. This is a CWE-22 path traversal flaw exploitable remotely by providing a specially crafted model download.

Affected products

DeepPavlov DeepPavlov up to 1.7.0

Timeline

2026-08-13: disclosed: Vulnerability report filed via GitHub issue #1711 by security researcher
2026-10-13: advisory: CVE-2026-109155 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.