CVE-2026-114040 DT42 CVE debrief

Who should care

DT42 BerryNet users, especially those with exposed or internet-facing deployments, should assess their version exposure and verify potential impacts. Security teams and administrators responsible for model package metadata handling systems should prioritize monitoring and remediation efforts.

Why it matters

This path traversal vulnerability in DT42 BerryNet's model package metadata handling requires attention from users with exposed or internet-facing deployments. While exploitation exists, specific impacts and victim organizations are not detailed. Defenders should assess exposure, monitor for unusual activity, and prioritize remediation.

• Potential unauthorized access to sensitive files or data
• Possible data exposure or leakage
• Need for verification of version exposure and system inventory
• Prioritization of remediation efforts for affected systems

Technical summary

The DLModelManager.get_model_meta function in berrynet/dlmodelmgr.py is vulnerable to path traversal attacks due to improper handling of the label argument. This allows remote attackers to potentially access unauthorized files or data. The vulnerability affects DT42 BerryNet up to version 3.10.2 and has been publicly disclosed. Users with exposed or internet-facing deployments should assess their version exposure and verify potential impacts. The vulnerability can be exploited remotely, and while specific impacts and victim organizations are not detailed, defenders should prioritize monitoring and remediation efforts.

Defensive priority

Medium priority for BerryNet users, especially those with exposed or internet-facing deployments, to assess and verify their versions and exposure.

Recommended defensive actions

• Assess and verify BerryNet version exposure, especially for deployments with internet-facing or externally accessible model package metadata handling
• Review and apply vendor remediation when available
• Monitor for potential unauthorized access or data exposure
• Inventory and track model package metadata handling systems for unusual activity
• Perform vulnerability scanning to identify exposed systems
• Implement network segmentation to limit lateral movement
• Review access controls and ensure principle of least privilege

Evidence notes

The CVE record and source item provide details on the vulnerability, its potential impact, and affected versions. However, there is limited information on actual exploitation or specific victim organizations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.