CVE-2026-108940: Path Traversal in EricLBuehler Mistral.rs

A path traversal vulnerability (CVE-2026-108940) was identified in EricLBuehler Mistral.rs up to version 0.9.3. The vulnerability is located in the calibration_apply function within mistralrs-server-core/src/handlers.rs. By manipulating the save_cimatrix argument, an attacker can perform path traversal attacks remotely. The vulnerability has been publicly disclosed, and an exploit is available. The issue is resolved by upgrading to version 0.9.4, which includes the patch identified by commit 8c81056712709b4845ec6d9531e4d35bab4a367c.

Successful exploitation of this vulnerability allows remote attackers to perform path traversal, potentially accessing or modifying files outside the intended directory scope. This could lead to unauthorized information disclosure or modification of critical files. The CVSS 4.0 score of 6.9 reflects a medium severity impact with network attack vector, no privileges required, and no user interaction needed.

Upgrade EricLBuehler Mistral.rs to version 0.9.4, which contains the official fix for this path traversal vulnerability. Applying the patch identified by commit 8c81056712709b4845ec6d9531e4d35bab4a367c fully remediates the issue. No additional mitigation steps are indicated by the vendor advisory.