Vulnerability · Published Jul 15, 2026 · Assigned by VulnCheck

CVE-2026-43637Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py

Critical 9.1

In plain English

A critical-severity path traversal in cornac from PreferredAI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.7%top 48.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loaders, which automatically download and extract archives, causing archive.extractall() to write files to arbitrary locations on the filesystem accessible to the running process.

Affected products (as reported)

Vendor	Product	Versions
PreferredAI	cornac	0 – before 2.6.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/cornac-path-traversal-via-extract-archive-in-download-py third-party-advisory