CVE-2026-115800
mediumA vulnerability was identified in UbiquitousLearning mllm up to 2.0.2.
A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/UbiquitousLearning/mllm/ cna@vuldb.com
- https://github.com/UbiquitousLearning/mllm/issues/711 cna@vuldb.com
- https://github.com/user-attachments/files/33258553/poc.zip cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-115800 cna@vuldb.com
- https://vuldb.com/submit/1022230 cna@vuldb.com
- https://vuldb.com/vuln/425982 cna@vuldb.com
- https://vuldb.com/vuln/425982/cti cna@vuldb.com