high · CVSS v3 6.3 · CVSS v4 5.3

CVE-2026-122188

A path traversal vulnerability exists in DeepGraphLearning's KnowledgeGraphEmbedding component, allowing remote attackers to manipulate the

Overview

A path traversal vulnerability exists in DeepGraphLearning's KnowledgeGraphEmbedding component, allowing remote attackers to manipulate the data_path argument during checkpoint loading. The flaw can lead to arbitrary file access and potential code execution. It is currently unpatched and publicly disclosed.

Description

A flaw has been found in DeepGraphLearning KnowledgeGraphEmbedding up to 2e440e0f9c687314d5ff67ead68ce985dc446e3a. Impacted is the function override_config of the file codes/run.py of the component Checkpoint Loading. This manipulation of the argument data_path causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Impact

Confidentiality: attackers can read arbitrary files. Integrity: may modify checkpoint files. Availability: could disrupt service. Defenders: system administrators, DevOps teams, security operations.

Remediation

Apply the latest patch when released. Until then, restrict file system access for the data_path argument, enforce strict path validation, and monitor for anomalous file access. Use container isolation and least privilege for the process.

Risk context

Severity high (CVSS v3 6.3). No EPSS data available. The vulnerability is publicly disclosed and exploitable remotely, so timely mitigation is recommended.

Affected products

  • DeepGraphLearning KnowledgeGraphEmbedding

Scores

Severity
high
CVSS v2
7.5
CVSS v3
6.3
CVSS v4
5.3
EPSS
—

path-traversal checkpoint-loading remote-exploit knowledge-graph deep-learning defense high-severity

← All CVEs

Related CVEs

high

CVE-2026-122009

DataLinkDC Dinky versions up to 1.2.5 contain a Server-Side Request Forgery (SSRF) vulnerability in the FlinkWebURITemplateProxyServlet component. This flaw allows remote attackers to manipulate the _authority argument to force the server to make requests to unintended internal or external targets. The vulnerability is critical for environments where Dinky acts as a proxy for Flink web interfaces.

View analysis

high

CVE-2026-86442

The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.

View analysis

high

CVE-2026-90965

The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.

View analysis

high

CVE-2026-122050

A vulnerability was found in Campcodes Complete Sales and Inventory System with Credit Management 1.0. This issue affects some unknown processing of the file /ahira/login.php. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

View analysis