# CVE-2026-118619: Ultralytics Google Drive download path traversal remote code execution

Source: https://junglewise.ai/threats/cve-2026-118619-ultralytics-google-drive-download-path-traversal-remote-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118619 · Severity: high · CVSS 8.8 · Published 2026-10-28

Ultralytics is a machine learning framework for computer vision tasks. A path traversal vulnerability in its Google Drive download functionality allows attackers to execute arbitrary code if a user visits a malicious webpage or opens a malicious file. This could give an attacker complete control over the user's system.

Technologies: [Ultralytics](https://junglewise.ai/threats/technologies/ultralytics-ultralytics). Vendors: [Ultralytics](https://junglewise.ai/threats/vendors/ultralytics).

## Quick answers

**Is CVE-2026-118619 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118619 being exploited in the wild.

**How severe is CVE-2026-118619?** High severity, with a CVSS score of 8.8, published 28 October 2026.

**Which products and versions are affected?** Ultralytics Ultralytics.

**Is there a fix for CVE-2026-118619?** No fixed version is recorded yet. Restrict user interaction with Ultralytics downloads from untrusted sources until a patch is available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-118619 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118619?** Check whether you run Ultralytics. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict user interaction with Ultralytics downloads from untrusted sources until a patch is available.

## Technical details

A path traversal flaw in Ultralytics' Google Drive download handler fails to validate user-supplied file paths before using them in file operations. An attacker can craft a malicious link or file that, when accessed by a victim, executes arbitrary code in the context of the Ultralytics process. User interaction is required.

## Affected products

- Ultralytics Ultralytics

## Timeline

- 2026-08-26: disclosed: Vulnerability reported to vendor
- 2026-10-28: advisory: Coordinated public release of advisory

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-818/](https://www.zerodayinitiative.com/advisories/ZDI-26-818/)

## Related threats

- [Ultralytics parse_model code injection remote code execution](https://junglewise.ai/threats/cve-2026-118618-ultralytics-parse-model-code-injection-remote-code-execution)
- [Ultralytics load_dataset_cache_file deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-118617-ultralytics-load-dataset-cache-file-deserialization-of-untrusted)
- [Ultralytics parse_model code injection remote code execution](https://junglewise.ai/threats/cve-2026-118616-ultralytics-parse-model-code-injection-remote-code-execution)
- [Ultralytics torch_safe_load command injection remote code execution](https://junglewise.ai/threats/cve-2026-118615-ultralytics-torch-safe-load-command-injection-remote-code)
- [Ultralytics check_det_dataset code injection remote code execution](https://junglewise.ai/threats/cve-2026-118614-ultralytics-check-det-dataset-code-injection-remote-code)