Ludwig: Path traversal in dataset archive extraction allows arbitrary file write
Summary
Ludwig, a low-code framework for building AI models, contains a path traversal flaw in its dataset archive extraction function. A crafted tar archive can contain a symlink or hard link that points outside the destination directory, followed by a file written through that link, so attacker-controlled content can be placed at arbitrary paths with the privileges of the extracting process. Exploitation requires a user to process an archive from an attacker-controlled or compromised source on Python 3.12 or 3.13; Python 3.14 is not affected.
Affected
- Ludwig versions before 0.17.8 (ludwig-ai/ludwig)
- Python 3.12 and 3.13 runtimes
- Python 3.14 is not affected
Fixed in
- Ludwig 0.17.8
Workaround
- No official workaround is listed. Upgrading to 0.17.8 or later is the vendor's recommendation.
- Only load datasets from trusted sources and pinned URLs with checksum verification.
Exploitation
- No known exploitation in the wild.
- No public proof of concept found at the time of research.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Upgrade Ludwig to version 0.17.8 or later where it is in use.
- Only process dataset archives from trusted, pinned sources.
- Run dataset loading as an unprivileged user in a container or sandbox without write access to sensitive paths.
- Check whether Ludwig is installed as a transitive dependency in your environments.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 7f534f3 github.com
- Ludwig release v0.17.8 github.com
- GitHub security advisory GHSA-qvrm-3x4c-rcxf github.com
- OpenCVE CVE-2026-104103 app.opencve.io
- Strix CVE-2026-104103 www.strix.ai
- Positive Technologies advisory mirror PT-2026-113968 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:05.
Original description (NVD)
Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The same containment check used os.path.commonprefix, so a sibling path sharing the destination's character prefix could also pass. The dataset-loading path can download and extract configured archive URLs, but exploitation requires a user to process an archive from a source controlled or compromised by the attacker on supported Python 3.12 and 3.13 runtimes. Python 3.14 is not affected because its default tar data filter rejects escaping links. This issue is fixed in version 0.17.8.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.