CVE-2026-120335 in farm
Summary
by MITRE • 11/02/2026
A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/language_model.py of the component Model Package Loader. The manipulation of the argument embeddings_filename leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The identified security flaw resides within the deepset-ai farm library, specifically affecting versions up to 0.8.0, and centers on a critical implementation error in the Model Package Loader component. The vulnerability is located in the WordEmbedding_LM.load function found in the file farm/modeling/language_model.py. This specific code path handles the loading of language model embeddings from disk storage, a routine operation for machine learning pipelines that rely on pre-trained models. However, the implementation fails to adequately sanitize or validate the input provided via the embeddings_filename argument before using it to construct filesystem paths. This lack of rigorous input validation creates an opportunity for local attackers to manipulate file path construction mechanisms, leading directly to a directory traversal vulnerability.
From a technical perspective, this issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core defect lies in the failure to normalize or restrict user-supplied input that determines which files are accessed by the application. When an attacker provides a crafted embeddings_filename containing relative path sequences such as dot-dot-slash, the underlying file system operations may resolve these references outside the intended directory structure. This allows the application to read arbitrary files from the local filesystem where the vulnerable software is executing. Because this vulnerability requires direct access to the execution environment of the affected application, it is categorized as a locally exploitable flaw rather than one that can be triggered remotely over a network without prior authentication or code execution capabilities on the host system.
The operational impact of this directory traversal weakness extends beyond simple unauthorized file reads in certain contexts. While the primary consequence is information disclosure through the ability to read sensitive configuration files, private keys, or other data stored alongside model artifacts, it can also serve as a stepping stone for more severe attacks if combined with other vulnerabilities. For instance, reading specific system files could reveal credentials or environment variables that facilitate further lateral movement within an organization's infrastructure. In environments where machine learning models are loaded from untrusted sources or shared directories, this flaw significantly increases the attack surface by allowing malicious actors to exfiltrate data that was not intended for public access. The ATT&CK framework maps this behavior to techniques involving Tactic: Collection and Technique: File and Directory Discovery, as well as potentially T1552 Unsecured Credentials if sensitive files are accessed.
It is important to note the context of support status regarding this vulnerability. The affected versions represent legacy software that has reached end-of-life or is no longer maintained by the original maintainer. Consequently, there will be no official patches or security updates released for these specific versions. Although an exploit has been disclosed publicly and may be utilized by threat actors to target systems still running outdated iterations of deepset-ai farm, mitigation strategies must rely on environmental controls rather than code fixes. Organizations should prioritize upgrading to supported versions if feasible, as newer releases likely address this input validation deficiency through proper path normalization libraries or strict allow-listing of permitted file extensions and directories.
For environments where immediate upgrade is not possible due to dependency constraints, defensive measures must be implemented at the infrastructure level. Deploying application whitelisting solutions can restrict which files are accessible by the Python process running farm. Additionally, configuring operating system-level permissions to limit read access for the user account executing the model loading routine can mitigate the impact of successful exploitation. Ensuring that machine learning workloads operate within isolated containers or virtual machines with minimal host filesystem exposure further reduces the risk profile associated with this legacy vulnerability. Given the vendor's lack of response and the unsupported status of the software, reliance on these compensating controls is essential to maintain security posture until migration to a supported alternative can be completed.