ZDI-26-818: Zero-Day in Ultralytics — Google Drive Download Path Traversal Enables RCE

Methodology note: This article relies solely on advisory ZDI-26-818 (internal case ZDI-CAN-32376), the only primary source available. Technical details beyond verbatim quotes cannot be verified from additional sources.

On October 28, 2026, Trend Micro Zero Day Initiative published advisory ZDI-26-818, documenting a zero-day vulnerability in the Ultralytics machine-learning framework. The flaw, cataloged as CVE-2026-118619 with a CVSS 3.1 score of 8.8, enables remote arbitrary code execution through a path traversal in the Google Drive download component. Coordinated disclosure followed the vendor's failure to respond to the August 26, 2026 report.

Documented Facts: What the ZDI Advisory Says

Advisory ZDI-26-818, internal case ZDI-CAN-32376, describes the vulnerability with technical precision. Per the official text: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics."

The mechanism resides in a specific feature. As the advisory states: "The specific flaw exists within the handling of downloads from Google Drive. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations." The lack of path sanitization enables the traversal.

On impact, the advisory is explicit: "An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process." The context remains that of the current process, with no documented escalation beyond this boundary.

A key element is the interaction requirement. The advisory indicates that "User interaction is required" for exploitation, specifying that the user must visit a malicious page or open a malicious file. This constraint limits the vector to scenarios with direct human involvement.

Timeline: From Report to 0-Day Disclosure

The vulnerability management timeline documents a broken dialogue. ZDI received the report on August 26, 2026 via the vendor's GitHub channel. On October 22, 2026, ZDI explicitly notified its intent to proceed with 0-day publication. Coordinated disclosure followed six days later, on October 28, 2026.

The period between report and publication spans 63 days. The vendor's lack of response is not annotated in the advisory with hypotheses about causes: the dossier provides no basis to distinguish between security backlog, project reorganization, or missed prioritization.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics"
— ZDI Advisory ZDI-26-818

Analysis: ML Context and Implications

Ultralytics is widely used for deploying YOLO models in computer vision. Its prevalence in training and inference pipelines makes any vulnerability in the model-acquisition flow from cloud repositories significant.

Downloading pre-trained models from Google Drive is a documented operational pattern in the framework. The combination of this pattern with the path traversal flaw creates a concrete attack surface for environments using the feature.

Three factors amplify the flaw's relevance. First: the framework's position in the software stack, typically with access to significant compute resources. Second: automation of ML pipelines, which can execute downloads without supervision after initial configuration — though constrained by the documented requirement for initial user interaction. Third: the absence of specific technical mitigation beyond generic interaction restriction.

The advisory concludes with a recommendation that offers no structural fix: "Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the product." For production deployments, this guidance presents clear operational constraints.

Recommended Actions

Operators using Ultralytics should evaluate restrictions on the Google Drive download feature, consistent with the sole mitigation cited by the advisory. The source does not specify attack vectors beyond the documented one nor prescribe additional technical actions.

The source does not specify whether unaffected Ultralytics versions exist, nor whether the vendor has released patches since disclosure. Operators should monitor the Ultralytics GitHub channel and the ZDI-26-818 advisory page for updates.

The source does not document attacks detected in the wild before October 28, 2026, nor provide specific indicators of compromise for this vulnerability.

Editorial Close

The ZDI-26-818 disclosure illustrates a recurring pattern in open-source ML ecosystem security: convenience features — automated cloud downloads — that become attack vectors due to missing input validation. Case ZDI-CAN-32376 adds a concrete data point to this landscape, with the known limitation of a single primary source.

The vendor's failure to respond to the August 26, 2026 report forced 0-day publication, leaving operators with a generic mitigation. The effective measure of protection depends on each environment's ability to implement interaction restrictions with the product, absent additional technical prescriptions in available sources.

Sources

• zerodayinitiative.com
• zerodayinitiative.com