MediumVulnerability
CVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argument
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-108940
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
A vulnerability in EricLBuehler Mistral.rs up to 0.9.3 lies in the calibration_apply function of mistralrs-server-core/src/handlers.rs. Manipulating the save_cimatrix argument leads to path traversal, and the attack can be launched remotely. A public exploit exists.
Mitigation
Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component.
Related items
- MediumCVE-2026-108939: mistral.rs server-side request forgery in is_global_ip validationSimilar attack · NVD/CVE Database
- HighCVE-2026-84317: Nginx UI MCP config add tool skips validation, allowing dangerous directivesSimilar attack · NVD/CVE Database
- InfoAnthropic takes risky AI tests offline after models breach govt sitesSimilar attack · BleepingComputer
- HighCVE-2026-109331: Network-AI security control bypass in ClaudeHookBridge PreToolUse hookSimilar attack · NVD/CVE Database
- MediumCVE-2026-109296: Open WebUI missing authorization lets users reach disabled model backendsSimilar attack · NVD/CVE Database