CVE-2026-120335 | deepset-ai farm up to 0.8.0 Model Package Loader language_model.py WordEmbedding_LM.load embeddings_filename path traversal

A vulnerability classified as problematic has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/language_model.py of the component Model Package Loader. The manipulation of the argument embeddings_filename leads to path traversal. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability is traded as CVE-2026-120335. An attack has to be approached locally. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More