CVE-2026-43637: Cornac Path Traversal Vulnerability

CVE-2026-43637 Overview

CVE-2026-43637 is a path traversal vulnerability [CWE-22] affecting Cornac, a Python recommender system framework developed by PreferredAI. Versions prior to 2.6.0 contain a Tar Slip flaw in the _extract_archive() function located in cornac/utils/download.py. A crafted TAR archive containing ../ sequences, absolute paths, or symlink and hardlink entries can cause archive.extractall() to write files outside the intended cache directory. The built-in dataset loaders trigger this behavior automatically by downloading and extracting archives during normal use, exposing any process that consumes untrusted datasets to arbitrary file write on the host filesystem.

Critical Impact
Attackers who control or tamper with a downloaded dataset archive can write arbitrary files to any location writable by the running Cornac process, enabling code execution through overwritten Python modules, cron files, or SSH keys.

Affected Products

Cornac recommender system framework versions before 2.6.0
Applications importing Cornac dataset loaders (for example cornac.datasets.movielens)
Python environments invoking cornac.utils.download._extract_archive() on untrusted TAR archives

Discovery Timeline

2026-07-15 - CVE-2026-43637 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-43637

Vulnerability Analysis

The vulnerability originates in Cornac's archive extraction helper. The _extract_archive() function opens downloaded TAR archives and calls Python's tarfile.TarFile.extractall() directly on the caller-supplied contents. Python's extractall() does not validate member paths against the destination directory before writing. TAR entries whose names begin with / or contain .. segments therefore resolve outside the intended cache directory when the archive is unpacked.

Cornac's dataset loaders automate the download and extraction of third-party datasets such as MovieLens. Any user who calls a loader that fetches a TAR archive from a compromised mirror, a tampered CDN, or a man-in-the-middle position implicitly invokes the vulnerable extraction routine. Symlink and hardlink members escalate the impact by redirecting subsequent writes to files that already exist on the host.

Root Cause

The root cause is missing path canonicalization and validation prior to extraction. extractall() was invoked without a member filter and without confirming that each resolved output path remained within the target directory. This pattern maps directly to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction beyond the normal use of Cornac's dataset APIs. An attacker who compromises a dataset host, poisons a package cache, or intercepts HTTP downloads can substitute a malicious TAR archive. When the target process extracts it, files land at attacker-chosen paths.

python

# Patch excerpt: cornac/utils/download.py
# Source: https://github.com/PreferredAI/cornac/commit/8a50be72c11569b6747c6b96d6e31a0a1962f1a8

 import os
-import shutil
+import sys
 import zipfile
 import tarfile
 from urllib import request

The companion change in cornac/datasets/movielens.py also switches dataset URLs from http:// to https://, reducing the ability of a network attacker to substitute archive contents in transit:

python

# Source: https://github.com/PreferredAI/cornac/commit/8a50be72c11569b6747c6b96d6e31a0a1962f1a8

 MovieLens = namedtuple("MovieLens", ["url", "unzip", "path", "sep", "skip"])
 ML_DATASETS = {
     "100K": MovieLens(
-        "http://files.grouplens.org/datasets/movielens/ml-100k/u.data",
+        "https://files.grouplens.org/datasets/movielens/ml-100k/u.data",
         False,
         "ml-100k/u.data",
         "\t",
         0,
     ),
     "1M": MovieLens(
-        "http://files.grouplens.org/datasets/movielens/ml-1m.zip",
+        "https://files.grouplens.org/datasets/movielens/ml-1m.zip",
         True,
         "ml-1m/ratings.dat",
         "::",
         0,
     ),

Detection Methods for CVE-2026-43637

Indicators of Compromise

Files created outside the Cornac cache directory (typically ~/.cornac/) by a Python process, especially in ~/.ssh/, ~/.config/, or site-packages paths.
TAR archives on disk whose members resolve to absolute paths or contain .. sequences when inspected with tar -tvf.
Unexpected symlinks appearing in the cache directory that point outside of it after a dataset download.

Detection Strategies

Inventory Python environments for Cornac versions below 2.6.0 using pip show cornac or SBOM tooling.
Add file integrity monitoring on directories writable by processes that import Cornac, alerting on writes originating from the Python interpreter outside the expected cache path.
Inspect proxy and web gateway logs for HTTP downloads of dataset archives from files.grouplens.org or other Cornac-referenced hosts served over plain http://.

Monitoring Recommendations

Log and review process ancestry for python processes that spawn shells, edit dotfiles, or modify SSH configuration shortly after network activity to dataset mirrors.
Alert on writes to authorized_keys, crontab, or Python site-packages files by non-package-manager processes.
Correlate dataset download events with subsequent filesystem changes to detect Tar Slip extractions in near real time.

How to Mitigate CVE-2026-43637

Immediate Actions Required

Upgrade Cornac to version 2.6.0 or later across all research, training, and production environments.
Audit machines that previously used Cornac dataset loaders for unexpected files, modified SSH keys, or altered Python packages.
Restrict outbound network access from data science hosts to a known list of trusted dataset mirrors, preferably over HTTPS.

Patch Information

The fix is delivered in the Cornac v2.6.0 release, landed via pull request #709 and commit 8a50be7. Additional context is available in the VulnCheck advisory on the path traversal.

Workarounds

Avoid invoking Cornac dataset loaders on untrusted TAR archives until upgrading to 2.6.0.
Run Cornac workloads inside a container or unprivileged user account with a read-only home directory and a scoped writable cache volume.
Manually pre-extract dataset archives with a hardened extractor that validates member paths, then point Cornac at the pre-extracted files.

bash

# Upgrade Cornac to the patched release
pip install --upgrade 'cornac>=2.6.0'

# Verify installed version
python -c "import cornac; print(cornac.__version__)"