MosaicML Composer EUVD-2026-98450

Exploitation requires the victim to load an attacker-controlled or untrusted checkpoint through MosaicML Composer's checkpoint-extraction path, where tarball.extractall processes archive entries without sanitizing paths (CWE-22). The concrete prerequisite is ingestion of a malicious checkpoint tarball (e.g., downloaded from a model hub, shared storage, or supply-chain source) by a deployment running Composer version 0.32.1 or earlier. The primary limiting factor is the required passive user interaction (UI:P): there is no automatic, unauthenticated path unless an environment already loads externally supplied checkpoints; teams that only load their own internally generated, trusted checkpoints are not realistically exposed.

This is a medium-severity (CVSS 4.0 base 5.3) path traversal in MosaicML Composer's checkpoint-extraction logic, and the available signals converge on genuinely moderate - not urgent - risk. The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates no authentication is required but mandates passive user interaction, meaning a victim must actually load an attacker-supplied checkpoint; this is the single most important risk-limiting factor. Impact is rated Low across confidentiality, integrity, and availability with no scope change, so even successful exploitation is bounded rather than catastrophic. No EPSS score was provided in the input, the CVE is NOT on CISA KEV, and no public exploit code (POC) is referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the network attack vector and the description - 'attack can be executed remotely' is consistent with AV:N because the malicious tarball can be delivered over the network, while UI:P correctly reflects that the user must trigger extraction. The key weakness in this assessment is source diversity: the entire record originates from a single researcher/source (VulDB), with no vendor advisory, no NVD CVSS enrichment independent of VulDB, and no confirmed patched version, so confidence in the precise affected-version boundary and impact ratings is limited. Net: treat as a real but lower-priority hardening item for teams that load untrusted/third-party checkpoints, not an emergency.

An attacker publishes a malicious model checkpoint (a crafted tarball) to a public model hub, shared artifact store, or supply-chain channel. A data scientist or ML pipeline using MosaicML Composer <= 0.32.1 loads that checkpoint, and tarball.extractall in composer/utils/checkpoint.py follows '../' entries to write files outside the intended extraction directory, overwriting or planting files on the host. No public POC is referenced, and exploitation requires the victim to initiate the checkpoint load (UI:P).