Threat database

CVE-2026-104103 is a path traversal vulnerability in ludwig-ai's ludwig framework prior to version 0.17.8. The flaw exists in the extract_archive() function, which improperly validates symlink and hard-link members in tar archives, allowing crafted archives to write files outside the intended extraction directory. This can lead to attacker-controlled content being placed at arbitrary filesystem paths with the privileges of the extracting process. The issue affects Python 3.12 and 3.13 runtimes but not Python 3.14, which rejects such escaping links by default. The vulnerability is fixed in version 0.17.8.