CVE-2026-117509

6.3 MEDIUMpublic exploit available

Published 2026-10-27 · Updated 2026-10-27

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses

CWE-22

Public exploit & PoC references

https://github.com/crownpku/Rasa_NLU_Chi/
https://github.com/crownpku/Rasa_NLU_Chi/issues/138
https://github.com/user-attachments/files/33302165/poc.zip

All references

https://github.com/crownpku/Rasa_NLU_Chi/
https://github.com/crownpku/Rasa_NLU_Chi/issues/138
https://github.com/user-attachments/files/33302165/poc.zip
https://vuldb.com/cve/CVE-2026-117509
https://vuldb.com/submit/1024527
https://vuldb.com/vuln/427075
https://vuldb.com/vuln/427075/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2012-20002PoC
HIGHCVE-2014-125130PoC
HIGHCVE-2014-125133PoC
HIGHCVE-2014-125134PoC
HIGHCVE-2015-20123PoC
HIGHCVE-2015-20124PoC
HIGHCVE-2015-20125PoC
HIGHCVE-2016-20100PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.