CVE-2026-109153: Path Traversal in MosaicML Composer

This vulnerability exists in the tarball.extractall function of the composer/utils/checkpoint.py file in MosaicML Composer up to version 0.32.1. The flaw allows an attacker to perform path traversal by manipulating the extraction process of checkpoint tarballs, potentially leading to unauthorized file writes outside the intended directory. The attack can be executed remotely without privileges or user interaction. The vendor was contacted early about this issue, but no patch or remediation details are currently provided.

An attacker can remotely exploit this vulnerability to perform path traversal during checkpoint extraction, potentially overwriting or creating files outside the expected directory structure. This could lead to unauthorized file modification or code execution depending on the environment and usage context. The impact is rated medium based on the CVSS score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a fix is available, avoid processing untrusted checkpoint tarballs or apply manual validation of extracted paths if possible.