Read the docs
TI-2026-85333 Aliases CVE-2026-122188GHSA-2h77-6hv6-rjwj

Path traversal in KnowledgeGraphEmbedding checkpoint loading

Priority MEDIUM 57CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

DeepGraphLearning KnowledgeGraphEmbedding up to 2e440e0f9c687314d5ff67ead68ce985dc446e3a is affected. The override_config function in codes/run.py does not limit the data_path argument to an intended directory, which is a path traversal flaw (CWE-22). A remote attacker needs no privileges but depends on passive user interaction to trigger it. A public exploit has been published.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A flaw has been found in DeepGraphLearning KnowledgeGraphEmbedding up to 2e440e0f9c687314d5ff67ead68ce985dc446e3a. Impacted is the function override_config of the file codes/run.py of the component Checkpoint Loading. This manipulation of the argument data_path causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00357 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DeepGraphLearningKnowledgeGraphEmbedding2e440e0f9c687314d5ff67ead68ce985dc446e3a—No fix listedCNA
  • KnowledgeGraphEmbedding VendorDeepGraphLearning Affected 2e440e0f9c687314d5ff67ead68ce985dc446e3a Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:deepgraphlearning:knowledgegraphembedding:*:*:*:*:*:*:*:*——DeepGraphLearning
  • cpe:2.3:a:deepgraphlearning:knowledgegraphembedding:*:*:*:*:*:*:*:* Versions — — ·DeepGraphLearning

Remediation

No fixed version is listed for KnowledgeGraphEmbedding, and the project has not responded to the early issue report.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-122188
  2. 2026-11-05 Alias added: GHSA-2h77-6hv6-rjwj
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: LOW → MEDIUM
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Exploit 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences