LM Studio: Path traversal in model downloader allows file writes outside models directory
Summary
LM Studio before 0.4.22+1 contains a path traversal flaw in the model downloader that lets a crafted model repository write files outside the models directory using backslash-separated filenames. An attacker can plant plugin and configuration files such as manifest.json, install-state.json and mcp-bridge-config.json, which can run an attacker-supplied Python payload on every launch. Exploitation requires a user to download the crafted model repository, but no attacker authentication is needed.
Affected
- LM Studio before 0.4.22+1 (CNA record: affected versions 0 to below 0.4.22+1)
- VulDB describes the range as up to 0.4.22+0
Fixed in
- 0.4.22+1 according to the CNA data (VulnCheck)
- The vendor's own wording for this fix could not be confirmed; the newest available build should be used
Workaround
- No vendor workaround found.
- Download models only from trusted publishers.
- Review the models directory for unexpected JSON files such as manifest.json, install-state.json or mcp-bridge-config.json outside the expected publisher/model structure.
- Restrict who can install models on affected systems.
Exploitation
- Not known to be exploited in the wild.
- No public exploit code indexed in Metasploit or Exploit-DB; no public nuclei template found.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
Our recommendation
- Inventory all LM Studio installations, including those on staff and developer workstations.
- Update to the newest LM Studio build, not only to 0.4.22+1.
- Only download models from trusted sources and check the models directory for unexpected files.
- Treat affected machines as compromised if unexpected files are found, since the payload reportedly runs on every launch.
- Prioritise this where staff use local LLM tools.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- LM Studio 0.4.22 Changelog lmstudio.ai
- VulnCheck Advisory: LM Studio Path Traversal via Model Downloader www.vulncheck.com
- VulDB entry 429281 vuldb.com
- Strix CVE-2026-119979 www.strix.ai
- Positive Technologies PT-2026-133731 vulners.com
- LM Studio model sideload documentation lmstudio.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:22.
Original description (NVD)
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.