{"id":"CVE-2026-117509","kind":"vulnerability","aliases":["CVE-2026-117509"],"related":[],"title":"Rasa NLU Chi: model persistor path traversal lets remote attackers reach files","description":"A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"Rasa_NLU_Chi up to 0.12.2 has a path traversal flaw in the model persistor's decompress function in rasa_nlu/persistor.py. A remote attacker can use crafted input to read or write files outside the intended model directory.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","python","rasa-nlu-chi","self-hosted"],"not_affected_if":["no-untrusted-model-archives"],"how_to_check":"- Check the installed version of Rasa_NLU_Chi against `0.12.2` (for example with `pip show rasa_nlu_chi` or the project's requirements file)\n- Look for `Persistor._decompress` in `rasa_nlu/persistor.py` to confirm the code path is present","fix":"- unknown: the sources report no fixed version and the project has not responded; restrict who can supply model archives and avoid loading untrusted models","status":"open","published_at":"2026-10-27T16:17:30+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:23+00:00","updated_at":"2026-10-27T16:34:23+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-27T16:34:23Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources report no fixed version and the project has not responded; restrict who can supply model archives and avoid loading untrusted models","reach":"internet","title":"Rasa NLU Chi: model persistor path traversal lets remote attackers reach files","impact":"medium","summary":"Rasa_NLU_Chi up to 0.12.2 has a path traversal flaw in the model persistor's decompress function in rasa_nlu/persistor.py. A remote attacker can use crafted input to read or write files outside the intended model directory.","category":"ai-tooling","nicknames":[],"who_cares":["python","rasa-nlu-chi","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker reads or writes files outside the model directory","analyst_note":"Check the NVD entry and the upstream issue for a patch, the exact trigger input, and whether the persistor is reachable remotely in default setups.","how_to_check":"- Check the installed version of Rasa_NLU_Chi against `0.12.2` (for example with `pip show rasa_nlu_chi` or the project's requirements file)\n- Look for `Persistor._decompress` in `rasa_nlu/persistor.py` to confirm the code path is present","needs_analyst":true,"not_affected_if":["no-untrusted-model-archives"],"who_is_affected":"Teams running Rasa_NLU_Chi up to 0.12.2 that load model archives through the Model Persistor, especially where those archives or their source can be influenced from outside. Deployments that do not use the persistor's decompress path or only load models they built themselves are less exposed; the sources do not say more.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3347,"output_tokens":611,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117509':15A,18A '-2026':14A,17A '0.12.2':35B,79C 'affect':80C 'ai':20B 'ai-tool':19B 'attack':10A,53B,102C 'chi':3A,26B,32B,76C 'compon':92C 'craft':56B 'crownpku':73C 'cve':13A,16A 'decompress':46B 'detect':71C 'directori':67B 'earli':123C 'exploit':108C 'file':12A,62B,87C 'flaw':40B 'function':47B,83C 'host':29B 'inform':119C 'input':57B 'intend':65B 'issu':126C 'launch':105C 'let':8A 'manipul':96C 'may':103C,113C 'model':4A,43B,66B,93C 'nlu':2A,25B,31B,75C 'nlu/persistor.py':50B,89C 'outsid':63B 'path':6A,38B,99C 'persistor':5A,44B,94C 'persistor._decompress':84C 'problem':122C 'project':117C 'public':111C 'python':22B 'rasa':1A,24B,30B,49B,74C,88C 'rasa-nlu-chi':23B 'reach':11A 'read':59B 'remot':9A,52B,106C 'report':127C 'respond':131C 'result':97C 'self':28B 'self-host':27B 'tool':21B 'travers':7A,39B,100C 'use':55B,115C 'vulner':69C 'write':61B 'yet':132C","nicknames":[],"mitigations":[],"who_affected":"Teams running Rasa_NLU_Chi up to 0.12.2 that load model archives through the Model Persistor, especially where those archives or their source can be influenced from outside. Deployments that do not use the persistor's decompress path or only load models they built themselves are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117509","severity":null,"published_at":"2026-10-27T16:17:30+00:00","modified_at":"2026-10-27T16:17:30+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}