Description
A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/language_model.py of the component Model Package Loader. The manipulation of the argument embeddings_filename leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-11-02
Score: 2.4 Low
EPSS: n/a
KEV: No
Impact: Local Path Traversal
Action: Upgrade or Mitigate
AI Analysis

Impact

A path traversal flaw exists in the WordEmbedding_LM.load function in the Model Package Loader component of deepset‑ai farm. An attacker who can run code locally on the same machine can supply a crafted embeddings_filename argument that causes the function to read files outside the intended directory. The vulnerability can expose arbitrary local files, but the CVSS score of 2.4 indicates it is a low‑severity issue when used in isolation.

Affected Systems

The weakness affects versions of deepset‑ai farm up to and including 0.8.0. Any environment where that software is installed, and no higher, is at risk. The flaw is limited to local execution; remote exploitation is not supported by the current description.

Risk and Exploitability

The vulnerability has a low CVSS score of 2.4 and no EPSS data, and it is not listed in the CISA KEV catalog. Because an attacker must run code locally to exploit the flaw, the risk is bounded to users who already have local access to the machine. The vendor did not publish a fix, so the flaw remains unpatched in the affected releases.

Generated by OpenCVE AI on November 2, 2026 at 04:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade deepset‑ai farm to a supported release newer than 0.8.0 that removes the path traversal bug.
  • If an upgrade cannot be performed, limit the local user or process that runs the application to a sandboxed environment (e.g., chroot, container, or non‑privileged user) so that the vulnerable function cannot read files outside its allowed scope.
  • For developers, modify the WordEmbedding_LM.load function to validate embeddings_filename by rejecting any path that contains directory traversal sequences (../) and ensuring it resolves within the expected embeddings directory.

Generated by OpenCVE AI on November 2, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 03:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/language_model.py of the component Model Package Loader. The manipulation of the argument embeddings_filename leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Title deepset-ai farm Model Package Loader language_model.py WordEmbedding_LM.load path traversal
First Time appeared Deepset-ai
Deepset-ai farm
Weaknesses CWE-22
CPEs cpe:2.3:a:deepset-ai:farm:*:*:*:*:*:*:*:*
Vendors & Products Deepset-ai
Deepset-ai farm
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 2.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Deepset-ai Farm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-02T03:00:13.656Z

Reserved: 2026-11-01T14:30:18.427Z

Link: CVE-2026-120335

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T03:17:30.873

Modified: 2026-11-02T03:17:30.873

Link: CVE-2026-120335

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T04:30:16Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')