mistral.rs EUVD-2026-98169

Requires the mistralrs-server HTTP API to be network-reachable and the online-calibration endpoint POST /calibration/apply to be invoked with a save_cimatrix argument containing a non-bare path (a leading /, a drive/absolute path, or ../ and / or \ separators) - the pre-patch code passed request.save_cimatrix straight into PathBuf::from with no validation. No authentication or user interaction is needed per the CVSS vector (PR:N/UI:N). Limiting factors: the server must actually expose the calibration/apply route to the attacker (binding to localhost or placing it behind authenticated proxy/network controls prevents remote reach), and impact is bounded to writing the server-generated .cimatrix file to an attacker-chosen location - the attacker does not control arbitrary file contents, so this is a file-placement/overwrite primitive, not direct code execution.

This is a moderate-priority issue, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L, score 6.9) is internally consistent with the description: a remote, unauthenticated (PR:N), low-complexity path-traversal write primitive against the mistral.rs HTTP server, with no confidentiality impact (VC:N) and only limited integrity/availability impact (VI:L/VA:L) because the attacker controls the destination path of a written .cimatrix file but not its arbitrary contents. A public exploit is reported (POC=YES), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of widespread or automated exploitation - the signals point to opportunistic, researcher-grade exploitation rather than mass campaigns. The one caveat to verify: the record is sourced solely from VulDB, and PR:N assumes the calibration/apply endpoint is exposed without authentication; since mistral.rs ships no default auth layer, PR:N is defensible, but operators who front the server with a reverse proxy or bind it to localhost sharply reduce exposure. Net: treat as a prompt-patch item for anyone exposing the mistral.rs server beyond localhost, but it does not carry the real-world urgency of a KEV-listed RCE.

An attacker who can reach the mistral.rs server's HTTP API sends a POST to /calibration/apply with a save_cimatrix value containing traversal sequences (e.g. ../../etc/ or an absolute path like /tmp/pwned.cimatrix), causing the importance-matrix file to be written outside the intended working directory. A public exploit is reported to exist, and the attack requires no authentication or user interaction per the CVSS vector; the realistic impact is overwriting or planting files at attacker-chosen locations, which can corrupt data or disrupt the service.