Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-124999— braindecode Hub Integration base.py EEGModuleMixin._from_pretrained path traversal

Quick assessment

Affected
n/a braindecode
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 braindecode 1.8.2 及更早版本中检测到安全漏洞。该漏洞影响组件"Hub Integration"中文件 braindecode/models/base.py 内的函数 EEGModuleMixin._from_pretrained。攻击者可通过操纵 filename 参数实现路径遍历。该攻击可远程执行，且利用方式已公开，可能被利用。升级至 2.0.0 版本可缓解此问题。相关补丁提交哈希为 05b764d93b9a50400f523206fbe03d73d0cf5edb。建议尽快升级受影响的组件。

CVSS 6.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-124999

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
braindecode Hub Integration base.py EEGModuleMixin._from_pretrained path traversal
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in braindecode up to 1.8.2. This affects the function EEGModuleMixin._from_pretrained of the file braindecode/models/base.py of the component Hub Integration. Such manipulation of the argument filename leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.0.0 mitigates this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. It is recommended to upgrade the affected component.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- braindecode 1.8.0 cpe:2.3:a:braindecode:braindecode:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-124999

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-124999

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-124999 (1)

Other References for CVE-2026-124999 (9)

Same Patch Batch · n/a · 2026-11-09 · 13 CVEs total

CVE-2026-124576 7.3 HIGH BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow
CVE-2026-124573 7.3 HIGH logseq Local HTTP API server.cljs validate-auth-token missing authentication
CVE-2026-124554 7.3 HIGH JeecgBoot JimuBI getAllChartData sql injection
CVE-2026-124625 6.3 MEDIUM PipraPay Admin Panel pp-functions.php deleteData sql injection
CVE-2026-124555 6.3 MEDIUM JeecgBoot Table Dictionary API getTableDictList JimuFormApiService.getTableDictList sql in
CVE-2026-124591 5.5 MEDIUM Bahleel CsvExporter.php fputcsv csv injection
CVE-2026-124624 5.3 MEDIUM PipraPay pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentials
CVE-2026-124623 4.7 MEDIUM PipraPay ZIP Archive system-settings-import unrestricted upload
CVE-2026-113702 4.3 MEDIUM iomad PDF Certificate lib.php local_iomad_pluginfile authorization
CVE-2026-124582 4.3 MEDIUM WebTorrent File Path torrent.js getFileModtimes path traversal
CVE-2026-124834 3.7 LOW iomad Password Field company_user.php store_temporary_password information disclosure
CVE-2026-124992 3.3 LOW nushell Data Conversion ser.rs escape_bytes control sequence

IV. Related Vulnerabilities

Same vendor: n/a
Same weakness: CWE-22