{"id":"CVE-2026-118619","kind":"vulnerability","aliases":["CVE-2026-118619"],"related":[],"title":"Ultralytics: Google Drive download path traversal allows code execution","description":"Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of downloads from Google Drive. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-32376.","summary":"Ultralytics mishandles user-supplied paths when downloading files from Google Drive, so a crafted path can write files outside the intended directory. An attacker can use this to execute arbitrary code in the context of the running process, but only after a victim visits a malicious page or opens a malicious file.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","python","self-hosted","ultralytics"],"not_affected_if":["fixed-local-models","no-google-drive-downloads"],"how_to_check":"- Check the installed Ultralytics version with `pip show ultralytics` and compare it to the fixed release listed in the advisory\n- Search the codebase for calls to Ultralytics download helpers that fetch Google Drive links, such as `attempt_download_asset`\n- Confirm whether the application passes user-controlled URLs or file names into Ultralytics download functions","fix":"- Upgrade the `ultralytics` package to the patched version named in the advisory (unknown in these sources)\n- Until patched, do not pass untrusted Google Drive links or file names to Ultralytics download functions","status":"open","published_at":"2026-10-28T17:18:29+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","triaged_at":"2026-10-28T17:36:16+00:00","updated_at":"2026-10-28T17:36:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T17:36:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `ultralytics` package to the patched version named in the advisory (unknown in these sources)\n- Until patched, do not pass untrusted Google Drive links or file names to Ultralytics download functions","reach":"internet","title":"Ultralytics: Google Drive download path traversal allows code execution","impact":"high","summary":"Ultralytics mishandles user-supplied paths when downloading files from Google Drive, so a crafted path can write files outside the intended directory. An attacker can use this to execute arbitrary code in the context of the running process, but only after a victim visits a malicious page or opens a malicious file.","category":"package","nicknames":[],"who_cares":["python","ultralytics","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code in the Ultralytics process after a victim interacts","analyst_note":"Find the affected and fixed Ultralytics versions and the patched download code, via the ZDI advisory for ZDI-CAN-32376 or the Ultralytics release notes, since the NVD entry alone gives no version range.","how_to_check":"- Check the installed Ultralytics version with `pip show ultralytics` and compare it to the fixed release listed in the advisory\n- Search the codebase for calls to Ultralytics download helpers that fetch Google Drive links, such as `attempt_download_asset`\n- Confirm whether the application passes user-controlled URLs or file names into Ultralytics download functions","needs_analyst":true,"not_affected_if":["no-google-drive-downloads","fixed-local-models"],"who_is_affected":"Teams that run Ultralytics in their own applications or services, especially where the download path or file name can be influenced by a user or by external content. Systems that use Ultralytics only with fixed local model files and never download from Google Drive are less exposed; the sources do not name specific affected versions.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":3417,"output_tokens":684,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118619':12A,15A '-2026':11A,14A '32376':176C 'affect':95C 'allow':7A,87C 'arbitrari':52B,92C,163C 'attack':46B,89C,156C 'code':8A,53B,82C,93C,164C 'context':56B,167C 'craft':36B 'current':170C 'cve':10A,13A 'directori':44B 'download':4A,29B,78C,129C 'drive':3A,33B,77C,132C 'execut':9A,51B,83C,91C,162C 'exist':124C 'exploit':104C 'file':30B,40B,74B,120C,153C 'flaw':123C 'googl':2A,32B,76C,131C 'handl':127C 'host':20B 'instal':96C 'intend':43B 'interact':100C 'issu':134C 'lack':138C 'leverag':158C 'malici':68B,73B,114C,119C 'mishandl':23B 'must':111C 'open':71B,117C 'oper':154C 'outsid':41B 'packag':16B 'page':69B,115C 'path':5A,27B,37B,79C,147C 'prior':148C 'process':60B,171C 'proper':140C 'python':17B 'remot':81C,88C 'requir':102C 'result':135C 'run':59B 'self':19B 'self-host':18B 'specif':122C 'suppli':26B,146C 'target':110C 'travers':6A,80C 'ultralyt':1A,21B,22B,75C,98C 'use':48B,150C 'user':25B,99C,145C 'user-suppli':24B,144C 'valid':141C 'victim':65B 'visit':66B,112C 'vulner':84C,86C,106C,160C 'within':125C 'write':39B 'zdi':174C 'zdi-can':173C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ultralytics in their own applications or services, especially where the download path or file name can be influenced by a user or by external content. Systems that use Ultralytics only with fixed local model files and never download from Google Drive are less exposed; the sources do not name specific affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:29+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118619","severity":null,"published_at":"2026-10-28T17:18:29+00:00","modified_at":"2026-10-28T17:18:29+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","fetched_at":"2026-10-28T17:34:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}