Search
Find a vulnerability
Search criteria
2 vulnerabilities by UbiquitousLearning
CVE-2026-115800 (GCVE-0-2026-115800)
Vulnerability from nvd – Published: 2026-10-23 20:30 – Updated: 2026-10-23 20:30
VLAI
EPSS
VEX
Title
UbiquitousLearning mllm Convertor __init__.py load_model path traversal
Summary
A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/425982 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/425982/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-115800 | third-party-advisory |
| https://vuldb.com/submit/1022230 | third-party-advisory |
| https://github.com/UbiquitousLearning/mllm/issues/711 | issue-tracking |
| https://github.com/user-attachments/files/3325855… | exploit |
| https://github.com/UbiquitousLearning/mllm/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| UbiquitousLearning | mllm |
Affected:
2.0.0
Affected: 2.0.1 Affected: 2.0.2 cpe:2.3:a:ubiquitouslearning:mllm:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquitouslearning:mllm:*:*:*:*:*:*:*:*"
],
"modules": [
"Convertor"
],
"product": "mllm",
"vendor": "UbiquitousLearning",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem0000000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T20:30:23.839Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-425982 | UbiquitousLearning mllm Convertor __init__.py load_model path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/425982"
},
{
"name": "VDB-425982 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/425982/cti"
},
{
"name": "CVE-2026-115800 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-115800"
},
{
"name": "Submit #1022230 | UbiquitousLearning mllm 2.0.2 (commit bc8f5cdb557f) Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1022230"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/UbiquitousLearning/mllm/issues/711"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/33258553/poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/UbiquitousLearning/mllm/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-23T17:04:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "UbiquitousLearning mllm Convertor __init__.py load_model path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-115800",
"datePublished": "2026-10-23T20:30:23.839Z",
"dateReserved": "2026-10-23T14:59:41.184Z",
"dateUpdated": "2026-10-23T20:30:23.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115800 (GCVE-0-2026-115800)
Vulnerability from cvelistv5 – Published: 2026-10-23 20:30 – Updated: 2026-10-23 20:30
VLAI
EPSS
VEX
Title
UbiquitousLearning mllm Convertor __init__.py load_model path traversal
Summary
A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/425982 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/425982/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-115800 | third-party-advisory |
| https://vuldb.com/submit/1022230 | third-party-advisory |
| https://github.com/UbiquitousLearning/mllm/issues/711 | issue-tracking |
| https://github.com/user-attachments/files/3325855… | exploit |
| https://github.com/UbiquitousLearning/mllm/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| UbiquitousLearning | mllm |
Affected:
2.0.0
Affected: 2.0.1 Affected: 2.0.2 cpe:2.3:a:ubiquitouslearning:mllm:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquitouslearning:mllm:*:*:*:*:*:*:*:*"
],
"modules": [
"Convertor"
],
"product": "mllm",
"vendor": "UbiquitousLearning",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem0000000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T20:30:23.839Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-425982 | UbiquitousLearning mllm Convertor __init__.py load_model path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/425982"
},
{
"name": "VDB-425982 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/425982/cti"
},
{
"name": "CVE-2026-115800 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-115800"
},
{
"name": "Submit #1022230 | UbiquitousLearning mllm 2.0.2 (commit bc8f5cdb557f) Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1022230"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/UbiquitousLearning/mllm/issues/711"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/33258553/poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/UbiquitousLearning/mllm/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-23T17:04:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "UbiquitousLearning mllm Convertor __init__.py load_model path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-115800",
"datePublished": "2026-10-23T20:30:23.839Z",
"dateReserved": "2026-10-23T14:59:41.184Z",
"dateUpdated": "2026-10-23T20:30:23.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}