Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104103— Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members

Quick assessment

Affected
ludwig-ai ludwig
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ludwig 是一个用于构建自定义大型语言模型（LLM）、神经网络及其他 AI 模型的低代码框架。在 0.17.8 版本之前， 函数在调用 之前会对 tar 包中的普通成员名称进行验证，但未对符号链接（symlink）成员或硬链接（hard-link）成员进行验证。攻击者可构造恶意 tar 归档文件，在其中创建一个指向提取目录之外的链接，随后通过该链接写入后续的成员文件，从而以执行提取操作的进程的权限，将攻击者控制的内容写入文件系统中的任意路径。 该漏洞所使用的边界检查机制依赖于 ，因此，只要某个同级路径与目标路径

CVSS 8.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
ludwig-ai ludwig < 0.17.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104103

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members
Source: CVE Program / CVE List V5
Vulnerability Description
Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The same containment check used os.path.commonprefix, so a sibling path sharing the destination's character prefix could also pass. The dataset-loading path can download and extract configured archive URLs, but exploitation requires a user to process an archive from a source controlled or compromised by the attacker on supported Python 3.12 and 3.13 runtimes. Python 3.14 is not affected because its default tar data filter rejects escaping links. This issue is fixed in version 0.17.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ludwig-ai ludwig < 0.17.8 -

II. Public POCs for CVE-2026-104103

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104103

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-104103 (1)

Other References for CVE-2026-104103 (2)

IV. Related Vulnerabilities

Same weakness: CWE-22

V. Comments for CVE-2026-104103

No comments yet

Leave a comment