| Title | crownpku Rasa_NLU_Chi 0.12.2, commit f995c06e5aee5b6f68ea877c1a271667357a1c68 Path Traversal |
|---|
| Description | A vulnerability was found in Rasa_NLU_Chi 0.12.2 (commit f995c06e5aee5b6f68ea877c1a271667357a1c68) and classified as high 8.8.
Affected is the _decompress function of the rasa_nlu/persistor.py model persistor component. The manipulation of the archive member names leads to a path traversal (tar-slip, CWE-22). It is possible to launch the attack remotely.
Technical Details
- Affected file/function: rasa_nlu/persistor.py:130-136 / Persistor._decompress, reached via Persistor.retrieve and the server-side model restore (rasa_nlu/project.py:210,246 _read_model_metadata -> _load_model_from_cloud)
- Vulnerable parameter: member names of the tar.gz model archive served from the configured cloud storage (AWS S3, GCS, Azure Blob)
- Attack vector: Network
- Privileges required: Low (ability to place or modify a model archive in the cloud storage the server pulls from)
- Trigger condition: a rasa_nlu server started with --storage aws|gcs|azure restores a model whose archive contains a member name with .. or an absolute path; tarfile.extractall() writes the member outside the target model directory with server-process privileges
Impact
- Confidentiality: High (arbitrary file write enables takeover paths such as authorized_keys or cron units)
- Integrity: High (arbitrary files writable with attacker-chosen content)
- Availability: High (overwriting service or OS files can take the server down)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
- Discovered: 2026-10-10
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Validate every archive member before extraction (reject absolute paths and names escaping target_path after normalization) or use tar.extractall(target_path, filter="data") per PEP 706 on Python >= 3.12 with a vendored equivalent for older interpreters. |
|---|
| Source | ⚠️ https://github.com/crownpku/Rasa_NLU_Chi/issues/138 |
|---|
| User | Dem000000 (UID 98564) |
|---|
| Submission | 10/11/2026 13:45 (17 days ago) |
|---|
| Moderation | 10/27/2026 10:01 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 427075 [crownpku Rasa_NLU_Chi up to 0.12.2 Model Persistor rasa_nlu/persistor.py Persistor._decompress path traversal] |
|---|
| Points | 20 |
|---|