mllm EUVD-2026-109158

Exploitation requires LOCAL access and the ability to control the 'shard_file' argument passed to the load_model function of the Convertor component (pymllm/mobile/convertor/__init__.py) in mllm versions up to 2.0.2. The CVSS vector's PR:L indicates the attacker needs low-level privileges - i.e., legitimate ability to run or feed input into the model-conversion tooling - so this is not remote or unauthenticated. The attack is limited by the local-only vector (AV:L): there is no network-facing exposure, and no user interaction by a victim is required (UI:N). The precise traversal trigger (specific traversal sequence or sanitization gap) is not described in the available sources beyond the manipulation of shard_file.

This is a medium-severity, low-priority issue rather than an urgent threat. The supplied CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:N) scores 4.8 and establishes that exploitation is LOCAL, not network-facing, and requires at least low privileges (PR:L) - the attacker must already be able to run or feed input to the Convertor component. The impact metrics are all Low (VC:L/VI:L/VA:L) with no scope change (SC/SI/SA:N), consistent with a bounded path-traversal read/write rather than full compromise. The SSVC/exploit-maturity signal is E:P (proof-of-concept), and the vuln.today decision label is 'this_month' - a routine remediation cadence, NOT act_now or emergency. No EPSS score and no CISA KEV entry are present in the input, so there is no evidence of active or widespread exploitation; a public PoC reference exists but is unverified. The combination - local vector, required privilege, low impact, PoC-only maturity, single reporting source (VulDB) - points to a genuine but non-critical defect. One caveat to verify: the data originates from a single source (VulDB) with no independent vendor confirmation, and the project has not responded, so affected-version and fix data cannot be corroborated.

A local user (or a process able to supply input to the model-conversion workflow) invokes the Convertor's load_model function with a crafted 'shard_file' argument containing directory-traversal sequences, causing the code to resolve a path outside the intended model directory. A public PoC reference (poc.zip) is linked but is not verified as working exploit code. Because the vector is local and requires low privileges, the scenario presupposes the attacker already has a foothold or legitimately drives the conversion tooling.