CVE-2026-43637 PreferredAI CVE debrief

Who should care

Defenders responsible for Cornac deployments, especially those using versions prior to 2.6.0, should assess their exposure and prioritize updating to version 2.6.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and update Cornac, review their deployment for exposure, and monitor for suspicious activity related to TAR archive downloads and extractions.

Why it matters

CVE-2026-43637 is a high-severity path traversal vulnerability in Cornac that allows attackers to write arbitrary files. Defenders should prioritize verifying and updating Cornac, reviewing their deployment for exposure, and monitoring for suspicious activity.

• Potential for arbitrary file writes on the filesystem accessible to the running process
• Possible disruption of service through unauthorized file modifications
• Need for verification of current Cornac version and exposure
• Priority for updating to version 2.6.0 or later

Technical summary

The CVE-2026-43637 vulnerability is a path traversal issue in Cornac versions before 2.6.0. It allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. This can be triggered through built-in dataset loaders that automatically download and extract archives.

Defensive priority

Defenders should prioritize verifying and updating Cornac to version 2.6.0 or later, and review their current deployment for potential exposure, especially if using versions prior to 2.6.0.

Recommended defensive actions

• Verify Cornac version and update to 2.6.0 or later if necessary
• Review current deployment for potential exposure, especially if using versions prior to 2.6.0
• Monitor for and restrict suspicious TAR archive downloads and extractions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its CVSS score of 8.8 and severity as HIGH. The vulnerability is described as a path traversal issue in Cornac before version 2.6.0, allowing attackers to write arbitrary files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.