CVE-2026-43637 Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py
Attackers can write arbitrary files outside the cache directory via crafted TAR archives in Cornac dataset loaders, potentially compromising the host filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-43637?
CVE-2026-43637 is a high-severity path traversal vulnerability in PreferredAI cornac, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loaders, which automatically download and extract archives, causing archive.extractall() to write files to arbitrary locations on the filesystem accessible to the running process.
Weakness: CWE-22
Which versions are affected by CVE-2026-43637?
How do I fix CVE-2026-43637?
No fix has been published for CVE-2026-43637 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-43637 being exploited?
There is no known exploitation of CVE-2026-43637 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-rrh3-cwwj-g5mg.