CVE-2026-92610 : Chi tiết

CVE-2026-92610

2026-11-03
08h42 +00:00
Directory Traversal
A01-Broken Access Control
2026-11-06
18h44 +00:00
Thông báo cho một CVE
Luôn được thông báo về mọi thay đổi đối với một CVE cụ thể.
Quản lý thông báo

Mô tả CVE

Improper limitation of paths in py-aspect-model-loader

In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x:  or @prefix x:  causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.

Thông tin CVE

Điểm yếu liên quan

CWE-ID Tên điểm yếu Nguồn
CWE-22 Improper Limitation of a Pathname to a Restricted Directory
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Tài liệu tham khảo