CVE-2026-108940

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108940
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108940.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108940
Published
2026-10-12T23:30:17Z
Modified
2026-10-16T02:31:10Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal
Details

A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108940.json"
}
References

Affected packages

Git / github.com/ericlbuehler/mistral.rs

Affected ranges

Type
GIT
Repo
https://github.com/ericlbuehler/mistral.rs
Events
Introduced
54957525b8b648108000af2004a4991cf08c0e69
Fixed
8c8105671
Fixed
8c81056712709b4845ec6d9531e4d35bab4a367c
Fixed
4400935451da5e2dc7379a3f92fbbada66557f6c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.9.0"
        },
        {
            "last_affected":  "0.9.0"
        },
        {
            "introduced":  "0.9.1"
        },
        {
            "last_affected":  "0.9.1"
        },
        {
            "introduced":  "0.9.2"
        },
        {
            "last_affected":  "0.9.2"
        },
        {
            "introduced":  "0.9.3"
        },
        {
            "last_affected":  "0.9.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.9.0
0.9.1
0.9.2
0.9.3
v0.*
v0.9.0
v0.9.1
v0.9.2
v0.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108940.json"