EsMF SDK Py Aspect Loader 2.1.2-2.2.1 Directory Traversal via URN
CVE-2026-92610 Published on November 3, 2026
Improper limitation of paths in py-aspect-model-loader
In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm: namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: <urn:samm:../../../foo:bar#> or @prefix x: <urn:samm:/abs/path:bar#> causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.
Weakness Type
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2026-92610 has been classified to as a Directory traversal vulnerability or weakness.
Affected Versions
Eclipse Foundation Eclipse Semantic Modeling Framework (ESMF):- Version 2.1.2, <= 2.2.1 is affected.