| 标题 | UbiquitousLearning mllm 2.0.2 (commit bc8f5cdb557f) Path Traversal |
|---|
| 描述 | A vulnerability was found in UbiquitousLearning mllm 2.0.2 (pymllm package, commit bc8f5cdb557f) and classified as high 7.1. Affected is the load_model function of the pymllm/mobile/convertor component. The manipulation of the weight_map shard filename argument in model.safetensors.index.json leads to a path traversal. User interaction is required because a victim must convert or load a crafted model package; the package needs to contain only JSON and SafeTensors data.
Technical Details
- Affected file/function: pymllm/mobile/convertor/__init__.py / load_model(), index branch lines 81-107
- Vulnerable parameter: weight_map shard filename value of model.safetensors.index.json
- Attack vector: Local (crafted model package delivered e.g. via a model hub or archive)
- Privileges required: None
- Trigger condition: os.path.join(index_dir, shard_file) at line 102 joins the attacker-controlled value with no absolute-path or ".." rejection and no resolved-path containment check; safetensors.safe_open then opens the escaped path and get_tensor returns the out-of-package values in the state_dict
Impact
- Confidentiality: High (tensor content is read from outside the model package and the official mllm-convertor CLI embeds it into the converted .mllm artifact; distinguishable errors disclose path existence/parseability)
- Integrity: High (attacker-selected values silently replace model weights and steer the behavior of real modules at forward() time)
- Availability: None (missing or unparseable shards raise a normal exception)
CVSS v3.1
Score: 7.1 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Timeline
- Discovered: 2026-10-07
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Reject absolute paths and ".." segments in weight_map shard values and verify that the resolved path stays inside the model directory (e.g. Path(index_dir, shard_file).resolve().is_relative_to(Path(index_dir).resolve())) before calling safe_open; add a regression test with a ".."-escaping and an absolute weight_map value. |
|---|
| 来源 | ⚠️ https://github.com/UbiquitousLearning/mllm/issues/711 |
|---|
| 用户 | Dem0000000 (UID 98743) |
|---|
| 提交 | 2026-10-09 17時58分 (15 日前) |
|---|
| 管理 | 2026-10-23 16時59分 (14 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 425982 [UbiquitousLearning mllm 直到 2.0.2 Convertor __init__.py load_model shard_file 目录遍历] |
|---|
| 积分 | 20 |
|---|