MEDIUM
UbiquitousLearning
CVE published 2026-10-23
CVE-2026-115800
A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2, specifically in the load_model function of the __init__.py file within the Convertor component. This vulnerability allows for path traversal attacks when the shard_file argument is manipulated. The attack must be performed locally, and a public exploit is available. The project has been informed but has not yet responded.