CVE-2026-115800 UbiquitousLearning CVE debrief

Who should care

Defenders of local systems using UbiquitousLearning mllm Convertor, developers responsible for validating input and securing file access, and teams managing software updates for affected versions (2.0.0, 2.0.1, 2.0.2).

Why it matters

CVE-2026-115800 is a path traversal vulnerability in UbiquitousLearning mllm Convertor that requires local access to exploit. Defenders should focus on input validation, restricted file access, and timely patching.

• Local attackers can exploit this vulnerability to traverse paths and potentially access unauthorized files.
• Successful exploitation may lead to information disclosure or further system compromise.
• Defenders need to validate input and restrict file access to mitigate this vulnerability.
• Remediation priority is medium, with a focus on applying patches or compensating controls.

Technical summary

The load_model function in the __init__.py file of the UbiquitousLearning mllm Convertor component is vulnerable to path traversal attacks due to improper sanitization of the shard_file argument. This allows local attackers to manipulate file paths, potentially leading to unauthorized file access or further system compromise. Defenders should focus on validating input and restricting file access to mitigate this vulnerability. The vulnerability affects UbiquitousLearning mllm up to version 2.0.2 and has a publicly available exploit.

Defensive priority

Medium priority for local system defenders and developers using UbiquitousLearning mllm Convertor, focusing on validating input and restricting file access.

Recommended defensive actions

• Review and validate input to the load_model function in __init__.py of the Convertor component.
• Restrict file access and ensure proper authorization for local system users.
• Monitor for and apply patches or updates from UbiquitousLearning as they become available.
• Consider compensating controls such as restricting local access to sensitive systems.
• Perform vulnerability scanning and asset inventory to identify exposed systems.
• Implement monitoring to detect potential exploitation attempts.
• Track exceptions and retest remediated assets.

Evidence notes

The CVE record and source item provide details on the vulnerability in UbiquitousLearning mllm Convertor. The NVD entry is currently not provided. Affected product deployments need confirmation in managed environments. Defenders should verify input validation and restricted file access. The project was informed of the problem early through an issue report but has not responded yet with a patch or update. Evidence limits suggest focusing on local system defenders and developers using UbiquitousLearning mllm Convertor.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.