EUVD-2026-111083
GHSA-pp2v-mwxg-7p57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privilege access to model storage
-
DeliverySupply crafted model archive
-
ExploitPersistor._decompress follows traversal path
-
ExecutionWrite file outside model directory
-
ImpactLow-impact integrity/confidentiality effect
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Model Persistor path: the Persistor._decompress function in rasa_nlu/persistor.py is reached when a model archive is decompressed during model loading/restore, and a manipulated archive yields path traversal (CWE-22). The CVSS 4.0 vector requires low-privilege authentication (PR:L) and no user interaction (UI:N), so the attacker must already be able to influence the model artifact or storage that the persistor retrieves and unpacks. Limiting factors: at least low-privilege access is required, the affected software is an unmaintained niche fork with versions 0.12.0 through 0.12.2 affected, and impact is low across all dimensions. The precise mechanism by which the traversal is triggered inside _decompress is not described in the available sources beyond 'manipulation results in path traversal'. |
| Impact | This is a low-priority issue by nearly every available signal. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores only 2.1, with low impact across confidentiality, integrity and availability (VC:L/VI:L/VA:L) and no subsequent-system impact (SC/SI/SA:N). The vuln.today decision label is 'monitor', the lowest urgency tier, and the record carries E:P (proof-of-concept) rather than any exploitation-maturity flag. There is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. A public PoC reference exists (a poc.zip attachment) but it is not verified as working exploit code, so PoC availability should not be read as confirmed exploitability. The PR:L metric indicates exploitation requires at least low-privilege authentication, which further limits real-world risk. The one notable amplifier is that the project (crownpku Rasa_NLU_Chi) is an unmaintained open-source repository that was notified via issue #138 and has not responded, so no fix is expected - but given the tiny deployment footprint and low impact, this remains a monitor-tier, not an act-now, item. EPSS data is missing; that gap should be noted but does not change the low-risk conclusion. |
| Exploit ScenarioDerived | An attacker with low-privilege access to a system that loads or restores Rasa_NLU_Chi models influences a model archive so that Persistor._decompress writes entries outside the intended model directory via path traversal (CWE-22). A public PoC reference (poc.zip) exists but is not verified as working exploit code, and the CVSS 4.0 vector indicates low privileges (PR:L) are required with no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Path traversal in the model persistor of crownpku Rasa_NLU_Chi (versions 0.12.0 through 0.12.2) lets an attacker who can influence a model archive that the Persistor later decompresses write outside the intended extraction directory, with low confidentiality, integrity and availability impact. The CVSS 4.0 vector (2.1, AV:N/AC:L/PR:L/UI:N) requires low-privilege access and the ability to supply or alter the model artifact being loaded or restored rather than simple anonymous reach. A public PoC reference exists; it is not verified as working exploit code, and there is no confirmed active exploitation (not in CISA KEV). The project was notified through GitHub issue #138 and has not responded, and no vendor-released patch has been identified at time of analysis, so the practical exposure is limited to deployments running this unmaintained fork.
RemediationAI
No vendor-released patch has been identified at time of analysis: the maintainers were notified through GitHub issue #138 (https://github.com/crownpku/Rasa_NLU_Chi/issues/138) and have not responded, and the VulDB record (https://vuldb.com/vuln/427075) lists no fixed version, so there is no exact upgrade target to cite for this fork. Compensating controls must therefore be applied at the deployment layer. First, restrict write access to whatever storage or repository holds the persisted models so that only trusted, reviewed artifacts can be loaded - this directly addresses the PR:L prerequisite, but it means enforcing supply-chain controls (signed or hash-pinned model bundles) on every model promotion, which adds release friction. Second, decompress and restore model archives inside a dedicated sandboxed directory or container with a read-only parent filesystem and no path outside the model root writable, so a traversal payload cannot land anywhere useful; the trade-off is extra infrastructure and a slower restore path. Third, where model archives are accepted from external parties, pre-validate the archive entries and reject any absolute paths or '..' components before invoking the persistor, accepting the manual gatekeeping cost. Given that this is an unmaintained niche fork with impact rated low across all dimensions and a Decision label of monitor, the most durable fix is migration to a maintained Rasa NLU release that is not affected by this persistor behaviour.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Rasa_NLU_Chi is a Chinese-language community fork of the Rasa NLU natural language understanding toolkit. The flaw sits in rasa_nlu/persistor.py, in the Persistor._decompress method, which is invoked when a persisted model archive is decompressed during model loading or restore. Because extraction paths are not adequately constrained, a manipulated archive can escape the intended target directory, which is the classic CWE-22 path traversal class: the code trusts path components supplied inside the artifact instead of canonicalising them against an expected base directory and rejecting absolute paths or '..' segments. The CPE cpe:2.3:a:crownpku:rasa_nlu_chi with a wildcard version, together with the EUVD data, places the affected range at 0.12.0, 0.12.1 and 0.12.2 (i.e. through 0.12.2). The trigger prerequisites are deployment-shaped: the CVSS 4.0 vector carries PR:L and UI:N, and the independent assessment confirms the attacker must already be able to influence the model artifact or the storage the persistor retrieves and unpacks. The precise mechanism by which the traversal is triggered inside _decompress is not described in the available sources beyond the statement that manipulation results in path traversal.
Know when Rasa Nlu Chi gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Decompression of a model archive is reachable over the network but needs low-privilege access to influence the artifact (PR:L); traversal gives limited file write/read, so C/I/A each Low.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB