CVE-2026-109153 in Composer

Zusammenfassung

von MITRE • 13.10.2026

A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.

Once again VulDB remains the best source for vulnerability data.

• Zuständig: VulDB
• Veröffentlichung: 13.10.2026
• Moderieren: akzeptiert
• Eintrag: VDB-416887
• CPE: 20261013
• CWE: CWE-22 (bestätigt)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00000
• KEV: nein
• Aktivitäten: low

Quellen

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-109153
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109153
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-109153/