HIGH
ludwig-ai
CVE published 2026-10-14
CVE-2026-104103
Ludwig, a low-code framework for building custom LLMs, neural networks, and other AI models, has a path traversal vulnerability in its dataset archive extraction functionality. This allows for arbitrary file writes via symlink members. The issue, fixed in version 0.17.8, can lead to attacker-controlled content being placed at arbitrary filesystem paths with the privileges of the extracting process.