CVE-2026-108940

EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal

View on CVE.org
Published Oct 12, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component.

Analysis

AI-generated

Technical impact

The flaw is in the calibration_apply function within mistral.rs, where manipulation of the save_cimatrix argument enables path traversal. This allows an attacker to reference files outside the intended directory, potentially exposing sensitive data or allowing unintended file writes if server permissions permit. The vulnerability can affect confidentiality and integrity by exposing or altering file contents.

Affected Systems

Mistral.rs, developed by EricLBuehler, is affected in versions up to 0.9.3. The fix is included in version 0.9.4, which closes the path traversal flaw in the server core file mistralrs-server-core/src/handlers.rs.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and while the EPSS score is not available and KEV does not list the vulnerability, the exploit is publicly available and can be triggered remotely by sending a crafted save_cimatrix value. Path traversal usually requires no special privileges, so the risk remains non‑negligible for unprotected deployments.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Mistral.rs to version 0.9.4 or later to eliminate the path traversal flaw.
  • Verify that the server no longer accepts malicious save_cimatrix arguments that reference files outside the intended directory.
  • If maintaining a custom fork, sanitize all file path inputs to enforce a whitelist of allowed directories, rejecting any traversal attempts.
  • Monitor server logs for repeated attempts to access restricted file paths and respond to suspicious activity.

Generated by OpenCVE AI on October 13, 2026 at 00:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component.
Title EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal
First Time appeared Ericlbuehler
Ericlbuehler mistral.rs
Weaknesses CWE-22
CPEs cpe:2.3:a:ericlbuehler:mistral.rs:*:*:*:*:*:*:*:*
Vendors & Products Ericlbuehler
Ericlbuehler mistral.rs
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 14, 2026, 12:47 PM
Reserved
Oct 11, 2026, 6:33 PM

View source JSON

Updated
Oct 14, 2026, 12:46 PM

JSON

Status
Deferred
Published
Oct 13, 2026, 12:17 AM
Modified
Oct 14, 2026, 1:17 PM

View source JSON

No data.

Updated
Oct 13, 2026, 2:00 AM

JSON