---
id: "CVE-2026-117509"
kind: "vulnerability"
aliases: ["CVE-2026-117509"]
title: "Rasa NLU Chi: model persistor path traversal lets remote attackers reach files"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "python", "rasa-nlu-chi", "self-hosted"]
not_affected_if: ["no-untrusted-model-archives"]
published_at: "2026-10-27T16:17:30+00:00"
first_seen_at: "2026-10-27T16:33:07+00:00"
updated_at: "2026-10-27T16:34:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117509", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# Rasa NLU Chi: model persistor path traversal lets remote attackers reach files

Rasa_NLU_Chi up to 0.12.2 has a path traversal flaw in the model persistor's decompress function in rasa_nlu/persistor.py. A remote attacker can use crafted input to read or write files outside the intended model directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Rasa_NLU_Chi against `0.12.2` (for example with `pip show rasa_nlu_chi` or the project's requirements file)
- Look for `Persistor._decompress` in `rasa_nlu/persistor.py` to confirm the code path is present

## Fix

- unknown: the sources report no fixed version and the project has not responded; restrict who can supply model archives and avoid loading untrusted models

## Timeline

- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117509

## From the sources

A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_