Medium 5.3

A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is...

CVE-2026-115800 First seen on SecPulse 05:30

Affected packages

Ecosystem	Package	Affected	Fixed
UbiquitousLearning	mllm	—	—

Original description The description as published by the source.

A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/init.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4: Low 1.9; CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Published: Oct 24, 2026
First seen on SecPulse: 05:30
GHSA: GHSA-39wj-q4qh-xrp2
CWE: CWE-22

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Path Traversal

CWE

Cwe 22

All

Ubiquitouslearning Mllm

Detection sources

NIST National Vulnerability Database06:17
GitHub Security Advisories (Global)06:36
CVE.org (CVE Program・cvelistV5)05:30