Ludwig CVE-2026-104103

Exploitation requires that a user invoke Ludwig's dataset-loading path (which downloads and extracts configured archive URLs via ludwig.datasets.archives.extract_archive) against a tar archive that the attacker controls or has compromised - this is the mandatory UI:R interaction. The archive must contain a symlink or hard-link member pointing outside the destination directory followed by a member written through that link, abusing both the missing link validation and the character-based os.path.commonprefix containment check. Exploitation is LIMITED to Ludwig versions prior to 0.17.8 running on Python 3.12 or 3.13; Python 3.14 is not exploitable because its default tar 'data' filter rejects escaping links. No authentication on the target system is needed (PR:N), but the attacker cannot succeed without the victim choosing to process the malicious archive from a source the attacker influences.

This is a genuine but conditional high-severity issue, not an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, base 8.1) accurately captures the shape of the flaw: a network-reachable archive path, low complexity, no privileges on the target, but mandatory user interaction (UI:R) - a user must choose to process an attacker-controlled or compromised archive. Impact is arbitrary file write (I:H, A:H) with no direct confidentiality loss (C:N), consistent with a path-traversal/link-escape write primitive rather than data disclosure. No EPSS score, CISA KEV listing, or published POC was supplied in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (there is no AV:N-vs-local-access contradiction here, because the dataset-loader does fetch remote archive URLs), but UI:R plus the requirement that the archive originate from an attacker-controlled source makes this targeted/social-engineering-dependent rather than wormable or mass-exploitable. The runtime scoping is an important mitigating fact independently confirmed by the vendor advisory and commit: only Python 3.12 and 3.13 are affected, because Python 3.14's default tar 'data' filter already rejects escaping links. Overall this warrants prompt patching for ML pipelines that ingest third-party datasets, but it is not a drop-everything internet-facing emergency.

An attacker publishes or compromises a dataset archive referenced by a configured URL; when a victim loads that dataset through Ludwig, extract_archive() processes a crafted tar containing a symlink that escapes the extraction directory followed by a regular file written 'through' that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges (e.g. overwriting a config, cron, or startup file to gain code execution). No public exploit code was identified in the supplied data, but the technique is well-understood and the vulnerable code path is confirmed in the fix commit. The attack only succeeds on Python 3.12/3.13 runtimes and requires the victim to initiate processing of the malicious archive.