Read the docs
TI-2026-84171 Aliases CVE-2026-92610GHSA-cmmf-wccr-xrrh

Path traversal in py-aspect-model-loader merges outside model files

Priority MEDIUM 49CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The esmf-sdk-py-aspect-model-loader package from the Eclipse Semantic Modeling Framework (ESMF), versions 2.1.2 through 2.2.1, is affected. The loader builds a directory to scan from the third and fourth components of urn:samm namespaces declared in a Turtle file, without restricting that path to the models root (CWE-22). A crafted model file with such a namespace makes the loader parse *.ttl files from arbitrary directories and merge them into the returned graph. An attacker who can supply a model file over the network needs no privileges and no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: <urn:samm:../../../foo:bar#> or @prefix x: <urn:samm:/abs/path:bar#> causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00403 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Semantic Modeling Framework (ESMF)2.1.2 – 2.2.1—No fix listedCNA
  • Eclipse Semantic Modeling Framework (ESMF) VendorEclipse Foundation Affected 2.1.2 – 2.2.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for esmf-sdk-py-aspect-model-loader.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-92610
  2. 2026-11-03 Alias added: GHSA-cmmf-wccr-xrrh
  3. 2026-11-06 CVSS score added · CISA ADP
  4. 2026-11-06 CISA SSVC decision points changed
  5. 2026-11-06 Priority changed: LOW → MEDIUM

References

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
  • TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
  • TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
  • TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
  • TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences