Live › vulnerability › CVE-2026-114040
Go to dashboardDT42 BerryNet up to 3.10.2 has a path traversal flaw in the get_model_meta function of its model package metadata handler, where the label argument is not sanitized. A remote attacker can use it to make the server read files outside the intended model directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running DT42 BerryNet up to version 3.10.2 that expose the service to a network where untrusted callers can reach the model metadata endpoint. The sources do not say which deployment settings or roles are required, so exposure is unknown beyond the affected version range.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get_model_meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114040")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.