CVE-2026-108940

A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component.

CVSS v3 6.5 MEDIUM
CVSS v2.0 6.4 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/EricLBuehler/mistral.rs/
https://github.com/EricLBuehler/mistral.rs/commit/8c8105671
https://github.com/EricLBuehler/mistral.rs/commit/8c81056712709b4845ec6d9531e4d35bab4a367c
https://github.com/EricLBuehler/mistral.rs/pull/2445
https://github.com/EricLBuehler/mistral.rs/releases/tag/v0.9.4
https://vuldb.com/cve/CVE-2026-108940
https://vuldb.com/submit/997601
https://vuldb.com/vuln/416764
https://vuldb.com/vuln/416764/cti
https://vuldb.com/submit/997601

Configurations

No configuration.

History

14 Oct 2026, 13:17

Type	Values Removed	Values Added
References	~~() https://vuldb.com/submit/997601 -~~	() https://vuldb.com/submit/997601 -

13 Oct 2026, 00:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-13 00:17

Updated : 2026-10-14 13:17

NVD link : CVE-2026-108940

Mitre link : CVE-2026-108940

CVE.ORG link : CVE-2026-108940

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-108940", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-108940", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-14T12:46:32.229776Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:ericlbuehler:mistral.rs:*:*:*:*:*:*:*:*"], "vendor": "EricLBuehler", "product": "Mistral.rs", "versions": [{"status": "affected", "version": "0.9.0"}, {"status": "affected", "version": "0.9.1"}, {"status": "affected", "version": "0.9.2"}, {"status": "affected", "version": "0.9.3"}, {"status": "unaffected", "version": "0.9.4"}]}]}], "published": "2026-10-13T00:17:00.523", "references": [{"url": "https://github.com/EricLBuehler/mistral.rs/", "source": "cna@vuldb.com"}, {"url": "https://github.com/EricLBuehler/mistral.rs/commit/8c8105671", "source": "cna@vuldb.com"}, {"url": "https://github.com/EricLBuehler/mistral.rs/commit/8c81056712709b4845ec6d9531e4d35bab4a367c", "source": "cna@vuldb.com"}, {"url": "https://github.com/EricLBuehler/mistral.rs/pull/2445", "source": "cna@vuldb.com"}, {"url": "https://github.com/EricLBuehler/mistral.rs/releases/tag/v0.9.4", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-108940", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/997601", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/416764", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/416764/cti", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/997601", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component."}], "lastModified": "2026-10-14T13:17:25.583", "sourceIdentifier": "cna@vuldb.com"}