Summary
Ludwig's archive extraction logic can be bypassed by crafted symlink or hard-link members, allowing files written during extraction to escape the intended destination directory. An attacker may place controlled content at arbitrary filesystem paths when a user processes an archive from an attacker-controlled or compromised source.
Ludwig's archive extraction logic can be bypassed by crafted symlink or hard-link members, allowing files written during extraction to escape the intended destination directory. An attacker may place controlled content at arbitrary filesystem paths when a user processes an archive from an attacker-controlled or compromised source.
Affected context
The issue occurs in Ludwig dataset-loading workflows that download and extract configured archives on supported Python 3.12 or 3.13 runtimes. Risk is present when archive contents are not fully checked for symlink and hard-link escape behavior and when the extraction process has write permissions beyond its intended dataset directory. Python runtimes with tar extraction filters that reject escaping links may reduce this specific exposure.
The issue occurs in Ludwig dataset-loading workflows that download and extract configured archives on supported Python 3.12 or 3.13 runtimes. Risk is present when archive contents are not fully checked for symlink and hard-link escape behavior and when the extraction process has write permissions beyond its intended dataset directory. Python runtimes with tar extraction filters that reject escaping links may reduce this specific exposure.
Exploit preconditions
- Attack surface: Dataset archive download and extraction
- Required access: Ability to cause a user or service to process an archive from an attacker-controlled or compromised source
- Trigger point: Extraction of crafted tar members during dataset loading
- Why exploitation is possible: Symlink and hard-link targets are not adequately contained, and the path check can accept sibling paths that merely share the destination's character prefix
- Attack surface: Dataset archive download and extraction
- Required access: Ability to cause a user or service to process an archive from an attacker-controlled or compromised source
- Trigger point: Extraction of crafted tar members during dataset loading
- Why exploitation is possible: Symlink and hard-link targets are not adequately contained, and the path check can accept sibling paths that merely share the destination's character prefix
Why this happens
The vulnerability results from incomplete archive-member validation before extraction. The implementation checks ordinary member names but does not apply equivalent containment checks to symbolic-link and hard-link targets, allowing a later archive member to write through an escaping link. The use of os.path.commonprefix also performs character-based rather than path-component-aware validation. This maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with a related CWE-59: Improper Link Resolution Before File Access condition.
The vulnerability results from incomplete archive-member validation before extraction. The implementation checks ordinary member names but does not apply equivalent containment checks to symbolic-link and hard-link targets, allowing a later archive member to write through an escaping link. The use of os.path.commonprefix also performs character-based rather than path-component-aware validation. This maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with a related CWE-59: Improper Link Resolution Before File Access condition.
Potential impact
- An attacker-controlled archive may write files outside the intended extraction directory
- Configuration, startup, or application files may be overwritten
- The extracting process may experience code execution indirectly if a writable executable or configuration path is targeted
- Dataset integrity and model-building workflows could be compromised
- Host or service confidentiality and availability could be affected
- An attacker-controlled archive may write files outside the intended extraction directory
- Configuration, startup, or application files may be overwritten
- The extracting process may experience code execution indirectly if a writable executable or configuration path is targeted
- Dataset integrity and model-building workflows could be compromised
- Host or service confidentiality and availability could be affected
General mitigation guidance
Mitigation generally focuses on treating archives as untrusted input and enforcing containment for every member type.
Common defensive patterns include:
- Use archive extraction APIs with secure, platform-supported data filters
- Resolve and validate regular files, directories, symbolic links, and hard links against the intended destination using path-aware containment checks
- Reject absolute paths, escaping link targets, and ambiguous or malformed archive entries
- Prefer extraction into isolated, temporary directories before publishing validated contents
- Restrict archive-processing privileges and filesystem write access to the minimum required locations
- Use trusted, integrity-verified archive sources and avoid silently following links during extraction
Mitigation generally focuses on treating archives as untrusted input and enforcing containment for every member type.
Common defensive patterns include:
- Use archive extraction APIs with secure, platform-supported data filters
- Resolve and validate regular files, directories, symbolic links, and hard links against the intended destination using path-aware containment checks
- Reject absolute paths, escaping link targets, and ambiguous or malformed archive entries
- Prefer extraction into isolated, temporary directories before publishing validated contents
- Restrict archive-processing privileges and filesystem write access to the minimum required locations
- Use trusted, integrity-verified archive sources and avoid silently following links during extraction
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis rules for archive extraction APIs used without secure filters or complete member validation
- Code review checks for
commonprefix-based path containment and unchecked link targets - Tests containing absolute paths, parent-directory traversal, symlinks, hard links, and destination-prefix sibling paths
- Runtime monitoring for archive extraction processes writing outside approved directories
- Filesystem policy enforcement that limits dataset services to isolated, least-privilege write locations
- Automated security review tools that flag unsafe archive extraction patterns and link-following behavior
Organizations can identify this class of issue through:
- Static analysis rules for archive extraction APIs used without secure filters or complete member validation
- Code review checks for
commonprefix-based path containment and unchecked link targets - Tests containing absolute paths, parent-directory traversal, symlinks, hard links, and destination-prefix sibling paths
- Runtime monitoring for archive extraction processes writing outside approved directories
- Filesystem policy enforcement that limits dataset services to isolated, least-privilege write locations
- Automated security review tools that flag unsafe archive extraction patterns and link-following behavior
