A path traversal flaw exists in the load_model function of UbiquitousLearning mllm. By manipulating the shard_file argument, an attacker who can execute code locally can cause the library to open files outside the intended directory. The flaw exposes sensitive files or configuration data and can be exploited using the publicly available proof‑of‑concept. The vulnerability is limited to local execution and does not provide a remote code‑execution vector.

The vulnerability affects the UbiquitousLearning mllm component up to version 2.0.2. Systems that run any of those releases and incorporate the Convertor module are susceptible.

The CVSS score of 4.8 indicates moderate severity. Because the attack requires local access, the overall threat is lower than a remote exploit, but it still allows a privileged attacker to read or modify files. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The publicly available exploit suggests that an internally compromised host could leverage the flaw, yet without prior host access the risk remains confined to the local environment.