CVE-2026-68770 @ mufasa

"CVE-2026-68770"
"filesystem"
"Am I vulnerable?"

Status

does_not_affect

Priority

7.96

Match score

2.5

Risk

RCE Remote priv:user

CVSS

9.8 CRITICAL

Reason

packages: filesystem

Created

2026-08-02T02:51:19Z

Updated

2026-08-02T09:08:48Z

Closed

2026-08-02T09:08:48Z

Package interrogation (copy)

Run on the host — click to copy a command. RPM

Package	Commands
filesystem

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: filesystem

System	Matches	Ticket for CVE-2026-68770
morris	emacs-filesystem 24.3; filesystem 3.2; firebird-filesystem 2.5.9.27139.0; firewalld-filesystem 0.6.3; fontpackages-filesystem 1.44; plesk-libboost-filesystem1.65 1.65.1; plesk-libboost-filesystem1.74 1.74.0.1; plesk-libboost-filesystem1.82 1.82.0 (+1 more)	does_not_affect open
mufasa	emacs-filesystem 24.3; filesystem 3.2; firebird-filesystem 2.5.9.27139.0; firewalld-filesystem 0.6.3; fontpackages-filesystem 1.44; libreport-filesystem 2.1.11; plesk-libboost-filesystem1.74 1.74.0.1; plesk-libboost-filesystem1.82 1.82.0 (+2 more)	does_not_affect open
Helios	libboost-filesystem1.74.0 1.74.0-9	none
Saiph	libboost-filesystem1.55.0 1.55.0+dfsg-3; libboost-filesystem1.62.0 1.62.0+dfsg-4	none

Same product CVEs in your queue

Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.

CVE	CVSS	Systems	Status	Matched	Already related
CVE-2026-67429	10.0	morris, mufasa	does_not_affect	filesystem	—
CVE-2026-45661	9.9	morris, mufasa	does_not_affect	filesystem	—
CVE-2025-40212	9.8	morris, mufasa	not_applicable	filesystem	—
CVE-2026-36829	9.8	morris, mufasa	does_not_affect	filesystem	—
CVE-2026-25879	9.8	morris, mufasa	does_not_affect	filesystem	—
CVE-2026-47162	8.8	Archive, Janus, Library, Matrix, Saiph	accepted_risk	filesystem	—
CVE-2023-4692	7.5	Archive, Janus, Library, Saiph, morris …	accepted_risk, fixed	filesystem	—

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

CloudLinux release 7.9 (Boris Yegorov) (7.9) · cloudlinux

Arch

x86_64

kernel_release

uname -r → 3.10.0-962.3.2.lve1.5.89.el7.x86_64

kernel_version

uname -v → #1 SMP Thu Jul 9 15:55:31 UTC 2026

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
morris	does_not_affect	7.96	2026-08-02T09:08:34Z	Open

Description

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local filesystem, regardless of the trust_remote_code=False argument. Attackers who can control or influence the contents of a model directory on disk can place malicious Python files such as modeling_*.py referenced via modules.json, causing the code to execute at import time when an application loads the model with SentenceTransformer(path, trust_remote_code=False), bypassing the documented security contract and achieving code execution within the loading process.

Determination

pip list 2>/dev/null | grep -i sentence-transformers
[root@morris ~]# pip3 list 2>/dev/null | grep -i sentence-transformers
[root@morris ~]# python3 -c "import sentence_transformers; print(sentence_transformers.__version__)" 2>/dev/null

Update status

Add note only

Mitigation log

2026-08-02T09:08:48Z — does_not_affect

pip list 2>/dev/null | grep -i sentence-transformers [root@morris ~]# pip3 list 2>/dev/null | grep -i sentence-transformers [root@morris ~]# python3 -c "import sentence_transformers; print(sentence_transformers.__version__)" 2>/dev/null

References

NVD: CVE-2026-68770