CVE-2026-92610
Improper limitation of paths in py-aspect-model-loader
In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: urn:samm:../../../foo:bar# or @prefix x: urn:samm:/abs/path:bar# causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Improper limitation of paths in py-aspect-model-loader
In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: urn:samm:../../../foo:bar# or @prefix x: urn:samm:/abs/path:bar# causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.
- Record
CVE-2026-92610- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-06
EUVDEUVD-2026-115715
In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: urn:samm:../../../foo:bar# or @prefix x: urn:samm:/abs/path:bar# causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.
- Record
EUVD-2026-115715- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-cmmf-wccr-xrrh
In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves...
In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: urn:samm:../../../foo:bar# or @prefix x: urn:samm:/abs/path:bar# causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.
- Record
GHSA-cmmf-wccr-xrrh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-06
NVD
In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: urn:samm:../../../foo:bar# or @prefix x: urn:samm:/abs/path:bar# causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.
- Record
CVE-2026-92610- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-06
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| severity | CVE List, NVD | |
| facts | GitHub Advisories | |
| published | EUVD | |
| published | EUVD, NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-92610 is a critical vulnerability (CVSS 9.8) in Eclipse Foundation Semantic Modeling Framework (esmf), published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. No source names a fixed version.