CVE-2026-124999
braindecode Hub Integration base.py EEGModuleMixin._from_pretrained path traversal
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A security vulnerability has been detected in braindecode up to 1.8.2. This affects the function EEGModuleMixin._from_pretrained of the file braindecode/models/base.py of the component Hub Integration. Such manipulation of the argument filename leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.0.0 mitigates this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. It is recommended to upgrade the affected component.
| CWE | CWE-22 |
| Vendor | n/a |
| Product | braindecode |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a braindecode
Be the first to know when new medium vulnerabilities affecting n/a braindecode are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / braindecode
1.8.0 1.8.1 1.8.2
References
vuldb.com: https://vuldb.com/vuln/433167 vuldb.com: https://vuldb.com/vuln/433167/cti vuldb.com: https://vuldb.com/cve/CVE-2026-124999 vuldb.com: https://vuldb.com/submit/1040628 github.com: https://github.com/braindecode/braindecode/issues/1440 github.com: https://github.com/braindecode/braindecode/pull/1494 github.com: https://github.com/user-attachments/files/33599273/poc.zip github.com: https://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb github.com: https://github.com/braindecode/braindecode/releases/tag/v2.0.0 github.com: https://github.com/braindecode/braindecode/
Credits
🔍 Dem00000 (VulDB User)