CVE-2026-109153 — MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint…
Published: 2026-10-13 · CVSS: 5.3 · CVSS 4.0
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7