CVE-2026-43637 is a path traversal (Tar Slip) vulnerability in PreferredAI's cornac library before version 2.6.0. The issue arises in the _extract_archive() function located in cornac/utils/download.py, where TAR archives containing malicious path components (e.g., ../ sequences, absolute paths, symlinks, or hardlinks) are extracted without proper validation. This allows attackers to write files outside the intended cache directory. The vulnerability can be exploited through cornac's built-in dataset loaders that automatically download and extract TAR archives, causing archive.extractall() to write files to arbitrary filesystem locations accessible by the process.

Successful exploitation allows an unauthenticated attacker to write arbitrary files to locations outside the intended cache directory on the filesystem accessible to the cornac process. This can lead to unauthorized file modification or creation, potentially enabling further attacks or system compromise depending on the environment and permissions of the running process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted TAR archives with cornac's dataset loaders or modify the _extract_archive() function to validate and sanitize archive paths before extraction to prevent path traversal. Monitor the PreferredAI cornac project for updates and apply official patches once released.