Critical Path Traversal RCE in Ultralytics Google Drive Integration (CVE‑2026‑118619)
What It Is — A zero‑day path‑traversal flaw (CVE‑2026‑118619) exists in Ultralytics’ handling of Google Drive downloads. An attacker can craft a malicious download path that, when a user visits a malicious page or opens a malicious file, causes the product to execute arbitrary code in the context of the running process. The vulnerability scores 8.8 (CVSS 3.1) and requires user interaction but no authentication. Ultralytics was notified on 2026‑08‑26; the advisory was publicly released on 2026‑10‑28. No vendor‑issued patch is available yet; mitigation guidance advises restricting interaction with the affected component.
Affected Products — Ultralytics software that integrates Google Drive download functionality (all current versions at time of advisory).
Why It Matters for Trust & Control Assurance — This flaw tests the control objective of secure software development and input validation—a single control that maps to many frameworks (e.g., NIST CSF Protect, ISO 27001 A.14). Demonstrating robust validation and evidence of secure‑coding practices strengthens audit readiness.
Recommended Actions
- Review and restrict use of the Google Drive download feature until a patch is released.
- Deploy runtime monitoring to detect unexpected process behavior or file‑system activity.
- Capture evidence of input‑validation controls for audit purposes.
- Follow Ultralytics’ advisory for any forthcoming patches or mitigations.