CVE-2026-124999

A security vulnerability has been detected in braindecode up to 1.8.2. This affects the function EEGModuleMixin._from_pretrained of the file braindecode/models/base.py of the component Hub Integration. Such manipulation of the argument filename leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.0.0 mitigates this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. It is recommended to upgrade the affected component.

• CWE-22

• https://github.com/braindecode/braindecode/
• https://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb
• https://github.com/braindecode/braindecode/issues/1440
• https://github.com/braindecode/braindecode/pull/1494
• https://github.com/braindecode/braindecode/releases/tag/v2.0.0
• https://github.com/user-attachments/files/33599273/poc.zip
• https://vuldb.com/cve/CVE-2026-124999
• https://vuldb.com/submit/1040628
• https://vuldb.com/vuln/433167
• https://vuldb.com/vuln/433167/cti

Published

Nov 9, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-124970Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2026-124987A vulnerability has been found in mikefarah yq up to 4.53.3.…6.3
• CVE-2026-124992A vulnerability was identified in nushell up to 0.116.1. Imp…3.3
• CVE-2026-124993An incorrect authorization vulnerability in the Security Adv…5.3
• CVE-2026-124994A security flaw has been discovered in Turboderp-org ExLlama…6.3
• CVE-2026-124996A weakness has been identified in Turboderp-org ExLlamaV3 up…6.3
• CVE-2026-1250The Court Reservation – Manage Your Court Bookings Online pl…7.5
• CVE-2026-12500The WP Travel Engine WordPress plugin before 6.8.2 does not…7.5
• CVE-2026-12501The WP Travel Engine WordPress plugin before 6.8.2 does not …5.3
• CVE-2026-12502Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo`…8.4
• CVE-2026-12503Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter`…9.2
• CVE-2026-12504Improper Authentication (CWE-287) in the PAM configuration i…8.4