CVSS 4.0
0.9 lowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PCVE-2026-120335
Low (0.9).
A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/language_model.py of the component Model Package Loader. The manipulation of the argument embeddings_filename leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
CVSS 3.1
4.8 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L- CWE
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path traversal)
- Published
- Modified
- Record from
- the NVD, synced
Ask an AI about this CVE
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CVE-2026-120335 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-120335?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-120335?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an estimate of exploitation activity across the internet over the next 30 days, not a prediction for my systems). Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.