CVE-2026-117509

MEDIUM 6.3

crownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-22
Vendor	crownpku
Product	rasa_nlu_chi
Published	Oct 27, 2026

Stay Ahead of the Next One

Get instant alerts for crownpku rasa_nlu_chi

Be the first to know when new medium vulnerabilities affecting crownpku rasa_nlu_chi are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

crownpku / Rasa_NLU_Chi

0.12.0 0.12.1 0.12.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/427075 vuldb.com: https://vuldb.com/vuln/427075/cti vuldb.com: https://vuldb.com/cve/CVE-2026-117509 vuldb.com: https://vuldb.com/submit/1024527 github.com: https://github.com/crownpku/Rasa_NLU_Chi/issues/138 github.com: https://github.com/user-attachments/files/33302165/poc.zip github.com: https://github.com/crownpku/Rasa_NLU_Chi/

Credits

🔍 Dem000000 (VulDB User) VulDB CNA Team