CVE-2026-117509 in Rasa_NLU_Chi
Summary
by MITRE • 10/27/2026
A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The identified vulnerability resides within the Rasa NLU Chinese component, specifically affecting versions up to 0.12.2 in the file rasa_nlu/persistor.py. This security flaw is located in the Persistor._decompress function, which is responsible for handling compressed model data files used by the natural language understanding engine. The core technical issue stems from a path traversal weakness where the application fails to adequately sanitize or validate file paths before processing decompression operations. When an attacker provides a maliciously crafted archive containing directory traversal sequences such as dot-dot-slash patterns, the system interprets these instructions literally rather than restricting extraction to the intended safe directory. This lack of input validation allows external data to dictate internal filesystem navigation logic, bypassing standard security boundaries designed to isolate application resources from arbitrary disk writes or reads.
From an operational perspective, this vulnerability enables remote attackers to achieve unauthorized access to sensitive files stored on the server hosting the Rasa NLU service. By leveraging public exploits that are already available in the wild, adversaries can manipulate the decompression process to write malicious payloads into critical system directories or read confidential configuration files and user data located outside the application's sandboxed environment. The impact extends beyond simple information disclosure; depending on the privileges under which the Rasa service runs, an attacker could potentially execute arbitrary code by overwriting executable scripts or configuration files that are subsequently loaded by the application. This represents a significant risk to the integrity and confidentiality of machine learning models and associated metadata managed by the NLU pipeline.
This flaw aligns with Common Weakness Enumeration category CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes scenarios where software does not properly neutralize path sequences that might resolve to a location outside of the intended directory. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with ATT&CK T1083: File and Directory Discovery, as well as potential lateral movement or persistence mechanisms if malicious files are written into executable paths. The fact that the project was notified via an issue report but has not yet responded indicates a gap in the vendor's incident response lifecycle for legacy versions of this open-source tool. Organizations relying on these older iterations must treat the risk as active and critical due to the availability of public exploitation code.
Mitigation strategies should prioritize immediate isolation or upgrading if possible, although given the age of the affected version, patching may not be straightforward without significant refactoring. Administrators should implement strict file system permissions to limit what the Rasa process can read or write, ensuring that even if path traversal occurs, the attacker cannot access sensitive areas of the operating system. Additionally, deploying a web application firewall with rules capable of detecting and blocking directory traversal patterns in HTTP requests targeting model upload endpoints can provide an additional layer of defense. It is also advisable to review any custom integrations using this library for similar input validation gaps and to monitor logs for unusual file access patterns indicative of exploitation attempts until the system can be migrated to a secure, supported version or replaced with a maintained alternative.