ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
Summary
| CVE | CVE-2026-58198 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-09 19:17:06 UTC |
| Updated | 2026-07-09 20:16:30 UTC |
| Description | ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract() uses a predictable home-rooted output directory (~/ubuntu_data/ubuntu_dialogs) with a check-then-create pattern followed by tar.extractall(path=self.data_path), allowing a local attacker who pre-plants a symlink at the predictable path to cause archive contents to be written through the symlink to an attacker-chosen directory. This issue is fixed in version 1.2.14. |
Risk And Classification
Primary CVSS: v3.1 5.5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.000950000 probability, percentile 0.008290000 (date 2026-07-12)
Problem Types: CWE-59 | CWE-367 | CWE-367 CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition | CWE-59 CWE-59: Improper Link Resolution Before File Access ('Link Following')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | DECLARED | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Gunthercox | ChatterBot | affected < 1.2.14 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/gunthercox/ChatterBot/releases/tag/1.2.14 | [email protected] | github.com | |
| github.com/gunthercox/ChatterBot/security/advisories/GHSA-wvrh-2f4m-924v | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | |
| github.com/gunthercox/ChatterBot/pull/2445 | [email protected] | github.com | |
| github.com/gunthercox/ChatterBot/commit/82817b5c28bfd43e682b991bcc76e6f7... | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.