AIKIDO-2026-196779

ludwig is vulnerable to Path Traversal

CVE-2026-104103Published Aug 4, 2026

CVE Score

High

Path Traversal

TL;DR

ludwig.datasets.archives.extract_archive() validates that every tar member name resolves inside the destination directory and then calls extractall(), but it never inspects symlink or hard-link member targets. A crafted archive can place a symlink pointing outside the destination followed by a regular file whose name resolves through that link, bypassing the check so that extractall() writes archive-controlled content to an arbitrary filesystem path with the privileges of the extracting process. The same containment check uses os.path.commonprefix, which compares characters rather than path components, so a sibling directory such as /data/dest-evil is treated as inside /data/dest. The fix validates link targets for symlinks and hard links, calls extractall() with filter="data", switches to os.path.commonpath, and raises a typed UnsafeArchiveError on violations.

How do I fix this?

Upgrade the ludwig library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you extract a dataset archive from an untrusted or externally controlled source through the dataset loading path (ludwig.datasets) on Python 3.12 or 3.13. Python 3.14 is not affected because extractall() defaults to filter="data", and there is no configuration flag that disables the affected path.