Ultralytics Google Drive path traversal zero-day can run attacker code
Original title: ZDI-26-818: (0Day) Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability
A user must open a malicious page or file; ZDI rates ZDI-26-818 at CVSS 8.8.
ZDI published ZDI-26-818, a zero-day path traversal in Ultralytics Google Drive download handling that can lead to remote code execution. Exploitation requires the target to visit a malicious page or open a malicious file. ZDI assigned CVSS 8.8. No versions, patch, or CVE are given.
Unconfirmed: Affected versions, a fix, and a CVE are not stated.
- The flaw is in Google Drive download handling.
- User interaction is required.
- ZDI labels it a 0Day.
- The assigned CVSS rating is 8.8.
Impact: remote code execution after user interaction
| Product | Affected |
|---|---|
| Ultralytics | — |
- Vendors
- Ultralytics
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.