| タイトル | SeldonIO MLServer 1.6.1 Path Traversal |
|---|
| 説明 | MLServer (Seldon / SeldonIO) up to 1.6.1 is vulnerable to path traversal (CWE-22) in the _extract_env() function in mlserver/env.py during model environment setup. When a model repository contains an environment_tarball, MLServer extracts it using tarfile without validating member paths against the target directory. A malicious environment_tarball can contain archive members with filenames using ".." directory traversal sequences, causing files to be written outside the intended extraction directory to arbitrary locations on the ML serving node filesystem. In multi-tenant or shared ML serving environments, this can lead to overwriting configuration files, writing SSH authorized_keys, or writing cron jobs for persistence. Exploitable by any user who can submit a model to the MLServer instance. Runtime-verified on the latest release. CVSS 9.9 Critical (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CWE-22 Path Traversal. Researcher: mohammad adnan (cystack.ps redteam). |
|---|
| ソース | ⚠️ https://github.com/SeldonIO/MLServer/issues/2553 |
|---|
| ユーザー | Anonymous User |
|---|
| 送信 | 2026年09月15日 00:35 (29 日 ago) |
|---|
| モデレーション | 2026年10月12日 13:58 (28 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 416889 [SeldonIO MLServer 迄 1.6.1 environment_tarball mlserver/env.py _extract_env ディレクトリトラバーサル] |
|---|
| ポイント | 20 |
|---|