A vulnerability exists in the untar function of DeepPavlov's Model Download Handler that allows an attacker to traverse directories and write files outside the intended extraction path. This path traversal flaw can be leveraged remotely, enabling an attacker to place malicious files or overwrite existing configurations. The flaw is classified as CWE‑22 and carries a CVSS score of 5.3, indicating moderate severity.

The issue impacts any installation of DeepPavlov up to version 1.7.0. Administrators running these versions should verify their local copies for any deployed models and assess whether the untar process is exposed to network input.

With the EPSS score not available and the vulnerability not listed in CISA KEV, there is currently no documented exploitation of this flaw, but the remote nature of the attack vector and the ability to modify the file system present a tangible risk. The official CVE notes that the development team has received an issue report but has not yet released a fix, so the risk exists until an update or a verified workaround is applied.