
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-58198 is a symlink-following arbitrary write vulnerability in ChatterBot's UbuntuCorpusTrainer.extract() method, classified as a TOCTOU (Time-of-Check Time-of-Use) race condition combined with improper link resolution. It affects all ChatterBot versions prior to 1.2.14 (pip package by gunthercox). The vulnerability was disclosed on June 19, 2026 via GitHub Security Advisory GHSA-wvrh-2f4m-924v, with the CVE published on July 9, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).
The root cause is a check-then-create pattern (CWE-367: TOCTOU Race Condition) combined with improper link resolution (CWE-59: Link Following) in UbuntuCorpusTrainer.extract(). The method uses a predictable, home-rooted output directory (~/ubuntu_data/ubuntu_dialogs) and checks for its existence with os.path.exists() — which follows symlinks — before calling os.makedirs(). If a local attacker pre-plants a symlink at ~/ubuntu_data/ubuntu_dialogs pointing to an attacker-controlled directory, os.path.exists() returns True (following the symlink), os.makedirs() is skipped, and the subsequent tar.extractall(path=self.data_path) writes archive contents through the symlink to the attacker's chosen target. The existing safe_extract function validated tar member names against zip-slip attacks using os.path.abspath() (which resolves symlinks), but did not validate whether self.data_path itself was a symlink, making the defense ineffective against this attack vector (GitHub Advisory, Fix Commit).
A local attacker with low privileges can cause archive contents extracted during ChatterBot's Ubuntu corpus training to be written to an arbitrary directory of their choosing, bypassing filesystem access controls. The primary impact is high confidentiality loss — by redirecting extraction to sensitive directories (e.g., overwriting configuration files, SSH authorized keys, or cron scripts), an attacker could escalate privileges or achieve persistent access. Integrity and availability are not directly impacted per the CVSS scoring, but the ability to write attacker-controlled files to arbitrary paths creates significant secondary risk for privilege escalation on multi-user systems (GitHub Advisory).
UbuntuCorpusTrainer is used or will be invoked (e.g., a shared ML training server or CI/CD environment).~/ubuntu_data/ubuntu_dialogs relative to the user running ChatterBot.mkdir -p ~/ubuntu_data
ln -s /attacker/chosen/target ~/ubuntu_data/ubuntu_dialogsUbuntuCorpusTrainer (e.g., by triggering a training job). The extract() method calls os.path.exists(self.data_path), which follows the symlink and returns True, skipping os.makedirs().tar.extractall(path=self.data_path) resolves the symlink via os.path.abspath(), making the attacker's directory the effective extraction root. All archive members with clean names pass the zip-slip check and are written to the attacker-controlled directory.authorized_keys, cron scripts, or Python files in a privileged path) can be leveraged for privilege escalation or persistent access (GitHub Advisory).~/ubuntu_data/ubuntu_dialogs (or a custom ubuntu_corpus_data_directory) pointing to an unexpected directory; unexpected files appearing in directories outside ~/ubuntu_data/ following a ChatterBot training run.~/.ssh/, /etc/cron.d/, Python site-packages) with timestamps coinciding with a ChatterBot training invocation.symlink creation at ~/ubuntu_data/ubuntu_dialogs by a user other than the ChatterBot process owner, followed shortly by tar extraction activity.~/ubuntu_data/ path, observable via strace, inotifywait, or EDR file monitoring (GitHub Advisory).Upgrade ChatterBot to version 1.2.14 or later, which adds an explicit symlink check (os.path.islink()) before extraction and rejects symlinked output directories with a TrainerInitializationException. The fix also switches is_within_directory() to use os.path.realpath() instead of os.path.abspath() and blocks symlink and hard link members within tar archives. As a temporary workaround on unpatched systems, ensure that the ~/ubuntu_data/ directory is created with appropriate permissions before running ChatterBot training, and monitor for unexpected symlinks at the predictable path (GitHub Release, Fix Commit).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."