CVE-2026-109153 | MosaicML Composer up to 0.32.1 Checkpoint Extraction checkpoint.py tarball.extractall path traversal (Issue 3942)

October 12, 2026 Yanac

A vulnerability categorized as critical has been discovered in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal.

This vulnerability is identified as CVE-2026-109153. The attack can be executed remotely. There is not any exploit available.

The vendor was contacted early about this disclosure.VulDB Recent EntriesRead More