---
id: CVE-2026-92610
title: Improper limitation of paths in py-aspect-model-loader
summary: "In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any\_urn:samm:…\_namespace declared in a parsed Turtl…"
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-22
vendor: Eclipse Foundation
product: Eclipse Semantic Modeling Framework (ESMF)
affected:
  - eclipse_semantic_modeling_framework_esmf >= 2.1.2 <= 2.2.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-06T18:43:44.199269Z'
published: '2026-11-03'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:44:07.455Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-92610'
references:
  - url: 'https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/969'
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/309'
tags:
  - cve.org
epss: 0.00403
epssPercentile: 0.34831
ingestedAt: '2026-11-05T19:30:42.932Z'
---

## Overview

In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: <urn:samm:../../../foo:bar#> or @prefix x: <urn:samm:/abs/path:bar#> causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.

## Affected

- `eclipse_semantic_modeling_framework_esmf >= 2.1.2 <= 2.2.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.