# CVE-2026-92610: Eclipse esmf-sdk-py-aspect-model-loader path traversal in namespace resolution

Source: https://junglewise.ai/threats/cve-2026-92610-in-esmf-sdk-py-aspect-model-loader-versions-2-1-2-to-2-2-1-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-92610 · Severity: info · Published 2026-11-03

The Eclipse ESMF Python Aspect Model Loader is a library that parses semantic model files to build graph-based representations of data structures. Versions 2.1.2 through 2.2.1 allow attackers to read arbitrary Turtle model files from the filesystem by crafting malicious @prefix declarations with path traversal sequences, potentially exposing sensitive model definitions or metadata.

Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation).

## Quick answers

**Is CVE-2026-92610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92610 being exploited in the wild.

**How severe is CVE-2026-92610?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** Eclipse Foundation Esmf-Sdk-Py-Aspect-Model-Loader 2.1.2 to 2.2.1.

**Is there a fix for CVE-2026-92610?** No fixed version is recorded yet. Do not load untrusted Turtle model files; restrict write access to model directories to trusted principals only. Validate or restrict the sources from which Aspect Model files are loaded.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92610 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-92610?** Check whether you run Eclipse Foundation Esmf-Sdk-Py-Aspect-Model-Loader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Do not load untrusted Turtle model files; restrict write access to model directories to trusted principals only. Validate or restrict the sources from which Aspect Model files are loaded.</anigation>
</invoke>

## Technical details

The LocalFileResolver component unsafely parses colon-separated components from urn:samm: namespace URIs declared in @prefix statements, passing them directly to os.path.join() without validation. An attacker can include path traversal sequences (../) or absolute paths in a crafted model file to cause the loader to glob and parse *.ttl files from arbitrary directories, merging their contents into the returned RDF graph. This is a path traversal vulnerability (CWE-22) that requires the attacker to control the input Turtle file being parsed.

## Affected products

- Eclipse Foundation esmf-sdk-py-aspect-model-loader 2.1.2 to 2.2.1

## Timeline

- 2026-11-03: disclosed

## References

- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/309](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/309)
- [https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/969](https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/969)