CVE-2026-92610

waiting for further signals

EUVD-2026-115715 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Eclipse Foundation Eclipse Semantic Modeling Framework (ESMF) >= 2.1.2, <= 2.2.1

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ETK-2026-3354, permanent identifier

3h 45msince last run

18mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+1h16m

+2h

+4h

+6h

+8h

+10h

+12h

description

esmf-sdk-py-aspect-model-loader versions 2.1.2 through 2.2.1 can follow model namespace references outside the configured models root. An attacker may cause the loader to read and merge local Turtle files from unintended directories when an application processes an untrusted model file.

mitigation

Do not process untrusted Turtle model files with affected versions, and run the loader with filesystem access limited to the intended model directory. Isolate the process from sensitive directories until a fixed release is available.

check

exploit

automation

contextual

auth required

–

EPSS

–

agent run time

18m

cve.org record, t = 0

2026-11-03 08:42Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-03 08:42Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-92610

this entry in the feed

GET /api/v1/feed/CVE-2026-92610

{
  "etk_id": "ETK-2026-3354",
  "cve_id": "CVE-2026-92610",
  "display_id": "CVE-2026-92610",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-115715",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in esmf-sdk-py-aspect-model-loader",
  "summary": "esmf-sdk-py-aspect-model-loader versions 2.1.2 through 2.2.1 can follow model namespace references outside the configured models root. An attacker may cause the loader to read and merge local Turtle files from unintended directories when an application processes an untrusted model file.",
  "mitigation": "Do not process untrusted Turtle model files with affected versions, and run the loader with filesystem access limited to the intended model directory. Isolate the process from sensitive directories until a fixed release is available.",
  "vendor": "Eclipse Foundation",
  "product": "Eclipse Semantic Modeling Framework (ESMF)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.1.2, <= 2.2.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Eclipse Semantic Modeling Framework (ESMF)",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 17.607063133333334,
  "t0_at": "2026-11-03T08:42:54.156000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T08:42:54.156000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T08:42:54.156000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92610"
    }
  }
}

published 2026-11-03 09:40Z
last change 2026-11-03 13:13Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.