CVE-2026-117509

Rasa_NLU_Chi cloud model archives can escape their extraction directory

crownpku · Rasa_NLU_Chi model persistor

First documented disclosure · Review checkpoint

Summary

A malicious cloud-stored model archive can overwrite files outside its intended restoration directory.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed primary sources establish a vulnerability and controlled reproduction, not real-world malicious exploitation. CISA KEV 2026.10.27 contains no exact-ID match; absence is not proof of no exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Persistor._decompress uses tarfile.extractall without validating archive paths.

Conditions required

Ability to place or modify an archive in the configured AWS/GCS/Azure model store, followed by a server restore using unsafe extraction behavior.

Potential impact

Arbitrary file writes with the server account’s permissions; later execution depends on overwriting code or configuration that is subsequently used.

Affected versions and configurations

CNA lists 0.12.0–0.12.2; the reported reproduction uses 0.12.2 at commit f995c06.

Fix and mitigation status

No fixed release established in the reviewed sources.

Practical next steps

Restrict model-store writers, verify archive provenance and enforce contained extraction with a safe data filter or equivalent validation.

Operating lesson

A model archive is an untrusted filesystem write operation.

Evidence and limits

October11 public issue predates October27 CVE. The controlled test demonstrates escaped file writes, not an observed compromise. Python extraction defaults vary; the researcher notes Python 3.14’s safer default. CNA 5.3/4.0 differs from researcher 8.8/3.1.

Sources