Ludwig was vulnerable to a path traversal flaw during archive extraction. The implementation validated tar member names but missed checking for symlink and hard‑link members. A crafted archive could create a link that escapes the intended extraction directory and then allow a later member to be written through that link, resulting in attacker‑controlled content being placed at an arbitrary filesystem path with the privileges of the Ludwig process. This flaw is a classic CWE‑22 and CWE‑59 vulnerability that permits arbitrary file overwrite and can serve as a foundation for remote code execution if the overwritten location is critical to the system's operation.

The affected product is Ludwig 0.17.7 and earlier from the vendor ludwig-ai. The issue exists for Python 3.12 and 3.13 runtimes; it does not affect Python 3.14 or newer because the built‑in tar data filter forbids escaping links.

The vulnerability carries a CVSS score of 8.1 and is not listed in the CISA KEV catalog. EPSS data is unavailable, but the absence of a specific exploitation score suggests it is not widely automated. The attack vector requires the attacker to supply a malicious archive URL that Ludwig will download and extract as part of dataset loading. Because the vulnerability is triggered during archive extraction, it is remote but requires the ability to influence dataset configuration or an attacker‑controlled source.