Attack Chain

1. Attacker creates a malicious TAR archive containing files with path traversal sequences (e.g., ../../etc/evil.sh, /usr/local/bin/backdoor).
2. The malicious TAR archive is distributed or made accessible to a system running a vulnerable version of Cornac.
3. A Cornac application, utilizing built-in dataset loaders, initiates a process to download and extract a dataset archive.
4. The malicious TAR archive is downloaded and supplied to Cornac's _extract_archive() function for processing.
5. The archive.extractall() method is invoked on the malicious archive without proper validation of file paths within the archive.
6. Due to the path traversal vulnerability, files from the archive are written by the Cornac process to arbitrary locations on the filesystem, outside the intended cache directory.
7. Successful exploitation can lead to overwriting critical system files, planting malicious executables, achieving persistence, or potentially leading to remote code execution.

Impact

Successful exploitation of CVE-2026-43637 allows an attacker to perform arbitrary file writes on the host system, which can have severe consequences. Depending on the attacker's objectives and the privileges of the Cornac process, this can lead to system compromise, data corruption, privilege escalation, or even remote code execution. Overwriting or creating files in critical system directories could render the system inoperable, facilitate persistent access, or allow the execution of attacker-controlled code. The high CVSS score of 9.1 reflects the critical nature of this vulnerability, indicating potential for complete loss of confidentiality, integrity, and availability.

Recommendation

• Patch CVE-2026-43637 immediately by upgrading Cornac to version 2.6.0 or later on all affected systems.
• Monitor process creation logs for unexpected file write operations, especially those originating from Cornac processes, to identify potential exploitation attempts.
• Implement file integrity monitoring on critical system directories and executables to detect unauthorized modifications that could result from arbitrary file writes.
• Restrict the permissions of user accounts running Cornac applications to the minimum necessary to limit the potential impact of file write vulnerabilities.