Description
Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loaders, which automatically download and extract archives, causing archive.extractall() to write files to arbitrary locations on the filesystem accessible to the running process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PreferredAI | cornac | < 2.6.0 | 2.6.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
rahulreddykarne/CVE-2026-43637-cornac ★ 0 · Aug 3, 2026
Path traversal (Tar Slip) in Cornac via _extract_archive (CVE-2026-43637)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cornac | < 2.6.0 | 2.6.0 | GHSA-rrh3-cwwj-g5mg |
References
- cornac 2.6.0 Release Notes release-notes
- Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/cornac-path-traversal-via-extract-archive-in-download-py third-party-advisory