CVE-2026-104103: Ludwig: tar symlink path traversal allows arbitrary file write

HIGH

Published October 14, 2026

CISO Take

Ludwig, a low-code framework for building custom LLMs and neural networks, had a flaw in its dataset archive extraction: it checked tar member names but not symlink or hard-link members, so a crafted archive can write attacker-controlled content to any path the process can reach. The CVSS score is 8.1 (high), and exploitation is network-reachable with low complexity but requires a user or pipeline to process an archive from an attacker-controlled or compromised source. There is no public exploit, no Nuclei template, no CISA KEV listing and no EPSS data, so there is no evidence of active exploitation today. Arbitrary file write in a training environment can lead to code execution (for example by overwriting shell profiles, cron entries or Python modules), and the exposure is highest on shared GPU hosts and CI runners that hold cloud credentials. Upgrade to Ludwig 0.17.8, and until then only load datasets from trusted, integrity-verified sources. Python 3.14 is not affected because its default tar data filter rejects escaping links.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High severity (CVSS 8.1) but with moderate real-world likelihood. The attacker needs no privileges, but the victim must extract a malicious archive, usually by pointing Ludwig at an attacker-influenced dataset URL or a compromised hosting source. Impact is high integrity and high availability loss, with no direct confidentiality impact in the vector. Only Python 3.12 and 3.13 runtimes are exploitable. There is no known exploitation, no public PoC and no EPSS score. Risk rises sharply where Ludwig runs as a privileged user, in shared notebooks, or in automated pipelines that fetch datasets from external URLs.

How does the attack unfold?

Initial Access

Attacker hosts or compromises a dataset archive that a Ludwig pipeline is configured to download.

AML.T0010.002

User Execution

A user or job runs the dataset loader, which calls extract_archive() on the crafted tar.

AML.T0011

Exploitation

A symlink or hard-link member escapes the extraction directory and a later member writes through it to an arbitrary path.

AML.T0010.001

Impact

Attacker-controlled files overwrite code or configuration, leading to code execution or corruption of the training environment.

Initial Access

Attacker hosts or compromises a dataset archive that a Ludwig pipeline is configured to download.

AML.T0010.002

User Execution

A user or job runs the dataset loader, which calls extract_archive() on the crafted tar.

AML.T0011

Exploitation

A symlink or hard-link member escapes the extraction directory and a later member writes through it to an arbitrary path.

AML.T0010.001

Impact

Attacker-controlled files overwrite code or configuration, leading to code execution or corruption of the training environment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
ludwig	—	—	No patch

Do you use ludwig? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CNone

IHigh

AHigh

What should I do?

1 step

1) Upgrade Ludwig to 0.17.8 or later. 2) If patching is delayed, run on Python 3.14, where the default tar data filter blocks escaping links. 3) Only load datasets from trusted sources, pin archive URLs and verify checksums or signatures before extraction. 4) Run training and data-loading jobs as an unprivileged user in a container or sandbox with a read-only filesystem except for the working directory. 5) Detection: inventory Ludwig versions with SBOM or pip tooling, inspect archives for symlink or hardlink members (tar -tvf) before extraction, and monitor for unexpected file writes outside dataset directories by training processes. 6) Rotate credentials on any host that processed untrusted archives.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionFrameworkTraining DataAML.T0010.001- AI Software AML.T0010.002- Data AML.T0011- User Execution

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.5-Data provenance

NIST AI RMF

MANAGE 2.3-Responses to unknown or emerging risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-104103?

Is CVE-2026-104103 actively exploited?

No confirmed active exploitation of CVE-2026-104103 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104103?

1) Upgrade Ludwig to 0.17.8 or later. 2) If patching is delayed, run on Python 3.14, where the default tar data filter blocks escaping links. 3) Only load datasets from trusted sources, pin archive URLs and verify checksums or signatures before extraction. 4) Run training and data-loading jobs as an unprivileged user in a container or sandbox with a read-only filesystem except for the working directory. 5) Detection: inventory Ludwig versions with SBOM or pip tooling, inspect archives for symlink or hardlink members (tar -tvf) before extraction, and monitor for unexpected file writes outside dataset directories by training processes. 6) Rotate credentials on any host that processed untrusted archives.

What systems are affected by CVE-2026-104103?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, data ingestion pipelines, low-code ML frameworks, shared notebook and CI environments.

What is the CVSS score for CVE-2026-104103?

CVE-2026-104103 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.49%.

What is the AI security impact?

Affected AI Architectures

training pipelinesdata ingestion pipelineslow-code ML frameworksshared notebook and CI environments

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0010.002Data

AML.T0011User Execution

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.5

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The same containment check used os.path.commonprefix, so a sibling path sharing the destination's character prefix could also pass. The dataset-loading path can download and extract configured archive URLs, but exploitation requires a user to process an archive from a source controlled or compromised by the attacker on supported Python 3.12 and 3.13 runtimes. Python 3.14 is not affected because its default tar data filter rejects escaping links. This issue is fixed in version 0.17.8.

Exploitation Scenario

An attacker publishes or compromises a dataset archive hosted on a mirror that a team's Ludwig config points to. The tar contains a symlink member pointing to the victim's home or site-packages directory, followed by a regular member written through that link. When a data scientist or CI job runs the dataset download, extract_archive() passes validation and writes a malicious Python file or shell profile entry outside the extraction directory. The next time the environment starts or the module is imported, the attacker's code runs with the user's privileges and can reach cloud credentials, training data and model artifacts.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-59Improper Link Resolution Before File Access ('Link Following')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.