Mllm
Monthly
Path traversal in UbiquitousLearning mllm through 2.0.2 allows local users with low-level privileges to manipulate the shard_file argument passed to load_model in the Convertor component, potentially reaching files outside the intended model-shard path; assessed impact is low for confidentiality, integrity and availability. The attack requires local access rather than network exposure, and a public PoC reference exists but is not verified as working exploit code. No CISA KEV listing or confirmed active exploitation is associated with this CVE.
Path traversal in UbiquitousLearning mllm through 2.0.2 allows local users with low-level privileges to manipulate the shard_file argument passed to load_model in the Convertor component, potentially reaching files outside the intended model-shard path; assessed impact is low for confidentiality, integrity and availability. The attack requires local access rather than network exposure, and a public PoC reference exists but is not verified as working exploit code. No CISA KEV listing or confirmed active exploitation is associated with this CVE.