DeepPavlov CVE-2026-109155

Exploitation requires the DeepPavlov Model Download Handler to fetch and extract an attacker-controlled tar archive through the vulnerable untar function; the archive must contain entries with traversal sequences (e.g. '../') so extraction writes outside the intended model directory. The key LIMITING factor is the passive user interaction (UI:P): a user or operator must initiate a model download/unpack operation pointing at or trusting the malicious archive - it is not triggerable without that action. Affects DeepPavlov versions up to and including 1.7.0; no vendor fix is confirmed as the project had not responded.

This is a moderate, low-priority issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) shows a network vector with low complexity and no privileges, but the Passive User Interaction requirement (UI:P) is the dominant limiting factor: a user or operator must initiate a model download/extraction that processes an attacker-supplied archive. Impact is uniformly Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change, yielding a base score of 5.3 (Medium). There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The Exploit Maturity is explicitly undefined (E:X). Signals are internally consistent - no conflict between vector and description - but the high-value signals that would elevate priority (active exploitation, automatability, public POC) are all absent. This reads as a genuine-but-low-urgency supply-chain/path-traversal weakness in a niche research library, not a mass-exploitation threat. Note the vendor has not responded to the issue report, so no patch is confirmed.

An attacker publishes or tampers with a model archive that DeepPavlov's Model Download Handler fetches and extracts via the vulnerable untar function; the archive contains entries with '../' path components. When a victim runs a DeepPavlov workflow that downloads and unpacks this model, files are written outside the intended model directory, potentially overwriting configuration or code paths. No public exploit code was identified in the provided data, and success depends on the victim initiating the download/extraction.