PrivacyMedium
CVE-2026-58198: ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.…
- Occurred
- Jul 9, 2026
- Published
- Jul 9, 2026
- Source
- NVD CVE
Summary
ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract() uses a predictable home-rooted output directory (~/ubuntu_data/ubuntu_dialogs) with a check-then-create pattern followed by tar.extractall(path=self.data_path), allowing a local attacker who pre-plants a symlink at the predictable path to cause archive contents to be written through the symlink to an attacker-chosen directory. This issue is fixed in version 1.2.14.
Tags
- CVE
- CVE-2026-58198
- cvss:MEDIUM
Classification
Category confidence: 85%
Severity confidence: 80%
Rationale: Symlink attack allows unauthorized file writes to attacker-chosen directories, representing a data integrity and potential privacy breach.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8