Invia #1022230: UbiquitousLearning mllm 2.0.2 (commit bc8f5cdb557f) Path Traversal

A vulnerability was found in UbiquitousLearning mllm 2.0.2 (pymllm package, commit bc8f5cdb557f) and classified as high 7.1. Affected is the load_model function of the pymllm/mobile/convertor component. The manipulation of the weight_map shard filename argument in model.safetensors.index.json leads to a path traversal. User interaction is required because a victim must convert or load a crafted model package; the package needs to contain only JSON and SafeTensors data.

Technical Details
- Affected file/function: pymllm/mobile/convertor/__init__.py / load_model(), index branch lines 81-107
- Vulnerable parameter: weight_map shard filename value of model.safetensors.index.json
- Attack vector: Local (crafted model package delivered e.g. via a model hub or archive)
- Privileges required: None
- Trigger condition: os.path.join(index_dir, shard_file) at line 102 joins the attacker-controlled value with no absolute-path or ".." rejection and no resolved-path containment check; safetensors.safe_open then opens the escaped path and get_tensor returns the out-of-package values in the state_dict

Impact
- Confidentiality: High (tensor content is read from outside the model package and the official mllm-convertor CLI embeds it into the converted .mllm artifact; distinguishable errors disclose path existence/parseability)
- Integrity: High (attacker-selected values silently replace model weights and steer the behavior of real modules at forward() time)
- Availability: None (missing or unparseable shards raise a normal exception)

CVSS v3.1
Score: 7.1 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Timeline
- Discovered: 2026-10-07
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Reject absolute paths and ".." segments in weight_map shard values and verify that the resolved path stays inside the model directory (e.g. Path(index_dir, shard_file).resolve().is_relative_to(Path(index_dir).resolve())) before calling safe_open; add a regression test with a ".."-escaping and an absolute weight_map value.

• Fonte: ⚠️ https://github.com/UbiquitousLearning/mllm/issues/711
• Utente: Dem0000000 (UID 98743)
• Sottomissione: 09/10/2026 17:58 (14 giorni fa)
• Moderazione: 23/10/2026 16:59 (14 days later)
• Stato: Accettato
• Voce VulDB: 425982 [UbiquitousLearning mllm fino a 2.0.2 Convertor __init__.py load_model shard_file directory traversal]
• Punti: 20