CVE-2026-109153
MEDIUM 5.3A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.5%chance of exploitation in 30 days · 42nd percentile
Impact if exploited
5.3CVSS 4.0 · MEDIUM
- ConfidentialityLow
- IntegrityLow
- AvailabilityLow
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: Succeeds with passive user activity
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-22: Path Traversal
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
References and research data (JSON)
All CVSS metrics
- MEDIUM 5.3 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X - MEDIUM 6.3 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C - MEDIUM 6.3 v3.0 · CNA Primary
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C - HIGH 7.5 v2.0 · CNA Primary
AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C - MEDIUM 5.3 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - MEDIUM 6.3 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - HIGH 7.5 v2.0 · NVD Secondary
AV:N/AC:L/Au:N/C:P/I:P/A:P
References
Advisories
- https://vuldb.com/cve/CVE-2026-109153 CVE record · VulDB · Updated 2026-10-13T10:00:20.259Z
NVD · CVE-2026-109153 · Updated 2026-10-16T18:17:30.243 - https://vuldb.com/submit/978647 CVE record · VulDB · Updated 2026-10-13T10:00:20.259Z
NVD · CVE-2026-109153 · Updated 2026-10-16T18:17:30.243 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98450 EUVD · EUVD-2026-98450
Technical & other
- https://vuldb.com/vuln/416887 CVE record · VulDB · Updated 2026-10-13T10:00:20.259Z
NVD · CVE-2026-109153 · Updated 2026-10-16T18:17:30.243 - https://vuldb.com/vuln/416887/cti CVE record · VulDB · Updated 2026-10-13T10:00:20.259Z
NVD · CVE-2026-109153 · Updated 2026-10-16T18:17:30.243 - https://github.com/mosaicml/composer/issues/3942 CVE record · VulDB · Updated 2026-10-13T10:00:20.259Z
NVD · CVE-2026-109153 · Updated 2026-10-16T18:17:30.243 - https://github.com/mosaicml/composer/ CVE record · VulDB · Updated 2026-10-13T10:00:20.259Z
NVD · CVE-2026-109153 · Updated 2026-10-16T18:17:30.243