Zero Day Initiative Discloses Ultralytics Google Drive Path Traversal RCE Vulnerability
A critical path traversal vulnerability in Ultralytics allows remote code execution by exploiting Google Drive download handling, rated CVSS 8.8.
The Zero Day Initiative (ZDI) has disclosed a critical remote code execution (RCE) vulnerability, tracked as ZDI-26-818, affecting installations of the Ultralytics software. This flaw, which carries a CVSS score of 8.8, can be exploited by attackers who trick users into interacting with malicious content, such as visiting a compromised webpage or opening a specially crafted file.
The vulnerability stems from an improper validation of user-supplied paths within the product's handling of downloads from Google Drive. This oversight allows an attacker to manipulate file operations by providing a malicious path, ultimately leading to the execution of arbitrary code within the context of the affected process. This means an attacker could potentially run commands, install malware, or take control of the system running Ultralytics.
Exploitation requires user interaction, a common characteristic for many software vulnerabilities. However, the ease with which users can be tricked into clicking links or opening files makes this a significant threat. The specific mechanism involves manipulating the download process from Google Drive, suggesting that attackers could craft malicious links or files that, when processed by Ultralytics, trigger the path traversal and subsequent code execution.
ZDI reported the vulnerability to the vendor on August 26, 2026, and after a period of follow-up and notification of their intent to publish, the advisory was made public on October 28, 2026. The timeline indicates a coordinated disclosure process, though the vendor's specific patch status is not detailed in the advisory, implying that users may still be at risk.
Given the nature of the vulnerability, which involves path traversal and arbitrary code execution, the primary mitigation strategy recommended by ZDI is to restrict user interaction with the product. This could involve implementing stricter security policies, user training, and potentially network segmentation to limit the impact of any successful exploitation.
This disclosure adds to a growing list of vulnerabilities found in popular software libraries and tools. Ultralytics, a widely used platform for deep learning model development, is now on the radar for security researchers and potential attackers. The nature of the vulnerability, tied to cloud storage integration, highlights the complex attack surface presented by modern software development workflows.
Users of Ultralytics are strongly advised to remain vigilant and consult any official security advisories from the vendor. While specific patch information is not yet available, proactive security measures and awareness of the exploitation vector are crucial for mitigating the risks associated with ZDI-26-818.