CVE-2026-104103: Ludwig archive extraction allows writes outside extraction directory

Summary

Ludwig versions before 0.17.8 have a path traversal flaw in ludwig.datasets.archives.extract_archive(). The function checks tar member names but not symlink or hard-link members, and uses os.path.commonprefix for its containment check, so a crafted archive can write files to arbitrary paths with the extracting process's privileges. Exploitation requires a user to process an archive from an attacker-controlled or compromised source on Python 3.12 or 3.13; Python 3.14 is not affected.

Mitigation

Fixed in 0.17.8.

Related items

• MediumAnthropic 'SneakPeek' Flaw Is a Silent Zero-Click ThreatSimilar attack · Dark Reading
• InfoFrom Training to Escalation: Forensic Analysis and Local Recreation of RL/RLHF-Induced Privilege Escalation in AI Agents (CVE-2026-65616)Similar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-110719: Portkey AI Gateway server-side request forgery via x-portkey-custom-host headerSimilar attack · NVD/CVE Database
• MediumAI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen FindsSimilar attack · SecurityWeek
• InfoBeyond Static Cues: Unified Dynamic Detection of MLLM Backdoors via Dual-Flow Trajectory AnalysisSimilar attack · Arxiv (cs.RO + cs.CV security)