CVE-2026-109956: Python Weka Model Path Containment Bypasscve-2026-109956-python-weka-model-path-containment-bypass
A caller-controlled model-artifact path reaches an external classifier/JVM command line as the value of a read/write option ("-l" read target, "-d" write target) without being bounded to the containment data roots. An attacker who controls the model path can make the external process write an arbitrary file via "-d" (e.g. ../../../etc/cron.d/evil or ~/.ssh/a
