What happened
A path traversal in WordEmbedding_LM.load in the deepset FARM NLP framework (published 2026-11-02, CVSS 3.1 4.8, CVSS 4.0 0.9) lets an attacker who controls the embeddings_filename escape the intended directory during model-package loading. A public PoC is disclosed, the vendor was non-responsive, and the product is marked unsupported-when-assigned.
Why it matters
Model-package loading is an ML-infrastructure trust boundary: a traversal in the embeddings filename turns a local model-loading operation into arbitrary file access, which matters where FARM (a predecessor to Haystack) is still used to load embeddings from untrusted or shared artifact paths.
Attack vector
The embeddings_filename argument is used to open an embeddings file without validated containment, so a path-traversal value lets an attacker read arbitrary files (or influence the model-loading path) on the machine where FARM is loading a model package.
Affected systems
deepset-ai farm (Model Package Loader, WordEmbedding_LM.load in farm/modeling/language_model.py) up to 0.8.0
Mitigation
FARM is end-of-life and the maintainer did not respond; avoid the framework or validate/contain embeddings_filename (resolve against the intended directory and reject '..'). No patched release.