CVE-2026-115800

The record

A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages

Related vulnerabilities

• CVE-2026-61725 sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. CWE-22
• CVE-2026-62965 SABnzbd is an open source automated Usenet download tool. CWE-22
• CVE-2026-119342 Stirling-PDF is a locally hosted web application that facilitates various operations on… CWE-22
• CVE-2026-119328 Immich is a high-performance self-hosted photo and video management solution. CWE-22
• CVE-2026-116249 In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and… CWE-22
• CVE-2026-116240 In server mode pgAdmin 4 validates a path into the user's storage directory with… CWE-22
• CVE-2026-62331 praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker… CWE-22
• CVE-2026-115604 Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. CWE-22