Live › vulnerability › CVE-2026-118619
Go to dashboardUltralytics mishandles user-supplied paths when downloading files from Google Drive, so a crafted path can write files outside the intended directory. An attacker can use this to execute arbitrary code in the context of the running process, but only after a victim visits a malicious page or opens a malicious file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Teams that run Ultralytics in their own applications or services, especially where the download path or file name can be influenced by a user or by external content. Systems that use Ultralytics only with fixed local model files and never download from Google Drive are less exposed; the sources do not name specific affected versions.
No product ranges from the sources yet.
pip show ultralytics and compare it to the fixed release listed in the advisoryattempt_download_assetultralytics package to the patched version named in the advisory (unknown in these sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of downloads from Google Drive. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-32376.
This page as .md · .json · in your agent: get_signal("CVE-2026-118619")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.