PreferredAI CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH PreferredAI CVE published 2026-07-15

CVE-2026-43637

CVE-2026-43637 is a path traversal vulnerability in Cornac versions before 2.6.0. The vulnerability allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive. This issue is triggered through the built-in dataset loaders which download and extract archives, leading to potential file writes to arbitrary locations on the filesystem.