CVE-2026-109153 in Composer
Summary
by MITRE • 10/13/2026
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in MosaicML Composer versions up to 0.32.1 represents a critical security flaw within the checkpoint extraction mechanism, specifically located in the tarball.extractall function found in the composer/utils/checkpoint.py module. This component is responsible for handling model checkpoints, which are essential artifacts used in machine learning workflows to save and restore training states. The core technical issue stems from an improper validation of archive member paths during the extraction process. When a maliciously crafted TAR file containing entries with relative path traversal sequences such as ../ or ..\ is processed by this function, it fails to sanitize these paths before writing them to the filesystem. This lack of input sanitization allows an attacker to control the destination directory where files are written, effectively bypassing intended containment boundaries within the application's working directory structure.
From a technical perspective, this flaw aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The vulnerability exploits the default behavior of Python’s tarfile module when extractall is called without specifying a safe destination directory that strictly limits output paths. In many implementations, if no specific directory is provided or if the validation logic is insufficient, the extraction process may resolve relative paths against the current working directory rather than a designated sandboxed location. This allows an attacker to write files outside of the expected checkpoint storage area, potentially overwriting critical system files, configuration scripts, or other sensitive data located in parent directories. The severity of this issue is compounded by its potential for remote execution, meaning that if the application accepts checkpoints from untrusted sources via a network interface, an adversary can exploit this flaw without prior authentication in certain deployment scenarios.
The operational impact of this vulnerability extends beyond simple file overwriting. An attacker who successfully exploits this path traversal could achieve arbitrary code execution on the target system by replacing executable scripts or libraries with malicious payloads that are subsequently loaded during normal application operation. Alternatively, they might disrupt service availability by corrupting essential configuration files or deleting critical data structures required for model training and inference. In cloud-native environments where MosaicML Composer is frequently deployed, this could lead to broader compromise of the underlying infrastructure if privilege escalation occurs through subsequent exploitation chains. The ability to write arbitrary files anywhere on the filesystem effectively breaks the isolation guarantees expected in containerized or virtualized ML workloads, posing significant risks to data integrity and confidentiality.
Mitigation strategies for this vulnerability involve both immediate patching and architectural improvements. Users should upgrade MosaicML Composer to version 0.32.2 or later, where the vendor has addressed the issue by implementing stricter path validation logic within the checkpoint extraction routine. This likely includes canonicalizing paths before comparison against allowed directories and rejecting any archive entries that attempt to escape the designated sandbox. Additionally, organizations relying on this software should enforce strict input validation policies for all incoming model checkpoints, treating them as untrusted data until proven safe. Implementing file integrity monitoring solutions can help detect unauthorized changes in critical directories resulting from successful exploitation attempts. Furthermore, adopting defense-in-depth measures such as running extraction processes within restricted containers with limited filesystem permissions and using read-only mounts where possible will reduce the blast radius of any potential compromise.
This incident highlights the importance of secure coding practices when handling archive files, a common attack vector across many software ecosystems. The vulnerability maps to ATT&CK technique T1083: File and Directory Discovery or more specifically T1564.002: Hidden Files and Directories if used for persistence, but primarily falls under initial access vectors involving malicious file uploads in the context of ML pipelines. Security teams should review their CI/CD pipelines to ensure that checkpoint sources are verified and signed before ingestion into training environments. Regular security audits focusing on third-party library usage within data science frameworks are essential to identify similar weaknesses in other components that handle external inputs. By addressing these vulnerabilities proactively, organizations can maintain the integrity of their machine learning infrastructure against evolving threats targeting AI/ML systems.