AIKIDO-2026-196779

ludwig is vulnerable to Path Traversal

Path TraversalGHSA-qvrm-3x4c-rcxf Published Aug 4, 2026

High Risk

This Affects:

ludwig

0.0.1 - 0.17.7

Fixed in 0.17.8

Are you affected? Scan for Free

TL;DR

ludwig.datasets.archives.extract_archive() validates that every tar member name resolves inside the destination directory and then calls extractall(), but it never inspects symlink or hard-link member targets. A crafted archive can place a symlink pointing outside the destination followed by a regular file whose name resolves through that link, bypassing the check so that extractall() writes archive-controlled content to an arbitrary filesystem path with the privileges of the extracting process. The same containment check uses os.path.commonprefix, which compares characters rather than path components, so a sibling directory such as /data/dest-evil is treated as inside /data/dest. The fix validates link targets for symlinks and hard links, calls extractall() with filter="data", switches to os.path.commonpath, and raises a typed UnsafeArchiveError on violations.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you extract a dataset archive from an untrusted or externally controlled source through the dataset loading path (ludwig.datasets) on Python 3.12 or 3.13. Python 3.14 is not affected because extractall() defaults to filter="data", and there is no configuration flag that disables the affected path.