CVE-2026-92610
Improper limitation of paths in py-aspect-model-loader
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: <urn:samm:../../../foo:bar#> or @prefix x: <urn:samm:/abs/path:bar#> causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.
| CWE | CWE-22 |
| Vendor | eclipse foundation |
| Product | eclipse semantic modeling framework (esmf) |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for eclipse foundation eclipse semantic modeling framework (esmf)
Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse semantic modeling framework (esmf) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Eclipse Foundation / Eclipse Semantic Modeling Framework (ESMF)
2.1.2 ≤ 2.2.1
References
Credits
Eclipse Foundation Security Team