PT-2026-109738 · Cohere Ai · Cohere-Python
CVSS v3.1
4.8
Medium
| Vector | AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N |
Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in s3 models dir to tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cohere-Python