CVE-2026-109153: MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-16
Weakness: CWE-22

Description

A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.

Affected products

MosaicML Composer: 0.32.0, 0.32.1

References

https://github.com/mosaicml/composer/
https://github.com/mosaicml/composer/issues/3942
https://vuldb.com/cve/CVE-2026-109153
https://vuldb.com/submit/978647
https://vuldb.com/vuln/416887
https://vuldb.com/vuln/416887/cti

Get alerted when CVE-2026-109153 or the next vulnerability affects your stack