CVE-2026-118619 in Ultralytics
Summary
by MITRE • 10/28/2026
Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of downloads from Google Drive. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-32376.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw represents a critical path traversal and remote code execution vulnerability within Ultralytics, specifically affecting components responsible for handling file downloads from Google Drive. This issue stems from an insufficient validation mechanism when processing user-supplied input paths. In secure software design, any external data used to construct file system operations must be rigorously sanitized to ensure it remains within the intended directory boundaries and does not reference sensitive or executable files outside of authorized contexts. The absence of such strict validation allows an attacker to manipulate path strings using standard traversal sequences, thereby bypassing expected access controls and reaching arbitrary locations on the host filesystem where malicious payloads can be placed or executed.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which directly facilitates remote code execution by allowing an attacker to control file operations beyond their intended scope. The operational impact is severe because it enables the execution of arbitrary commands with the privileges of the current process context. This means that if a user or automated system interacts with a compromised download link, the resulting code execution can lead to full system compromise, data exfiltration, lateral movement within a network, or installation of persistent backdoors depending on the permissions granted to the application running Ultralytics.
Exploitation of this vulnerability requires user interaction, as it relies on social engineering tactics such as tricking a target into visiting a malicious webpage containing crafted links or opening a specially constructed file that triggers the vulnerable download handler. This characteristic aligns with ATT&CK technique T1059: Command and Scripting Interpreter, where attackers use legitimate system tools to execute code after gaining initial access through this path traversal flaw. The requirement for user interaction does not diminish the severity but rather defines the attack vector as a client-side or application-level compromise that depends on human error in handling untrusted sources.
Mitigation strategies must focus on implementing strict input validation and output encoding practices. Developers should enforce allow-listing of permitted characters in file paths, resolve all symbolic links to their canonical forms before processing, and ensure that the final resolved path remains within a predefined safe directory root. Additionally, employing sandboxed environments for handling untrusted files can limit the blast radius of any successful exploitation. Organizations using Ultralytics should apply vendor-provided patches immediately if available or implement compensating controls such as network-level filtering to block access to known malicious domains and enforce strict content security policies that prevent unauthorized script execution from external sources.