A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal.
The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.9.4 is sufficient to fix this issue.
The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 9
https://github.com/EricLBuehler/mistral.rs/
cna@vuldb.com
https://github.com/EricLBuehler/mistral.rs/commit/8c8105671
cna@vuldb.com
https://github.com/EricLBuehler/mistral.rs/commit/8c81056712709b4845ec6d9531e4d…
cna@vuldb.com
https://github.com/EricLBuehler/mistral.rs/pull/2445
cna@vuldb.com
https://github.com/EricLBuehler/mistral.rs/releases/tag/v0.9.4
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-108940
cna@vuldb.com
https://vuldb.com/submit/997601
cna@vuldb.com
https://vuldb.com/vuln/416764
cna@vuldb.com
https://vuldb.com/vuln/416764/cti
cna@vuldb.com