| Title | SeldonIO MLServer 1.6.1 Path Traversal |
|---|
| Description | MLServer (Seldon / SeldonIO) up to 1.6.1 is vulnerable to path traversal (CWE-22) in the _extract_env() function in mlserver/env.py during model environment setup. When a model repository contains an environment_tarball, MLServer extracts it using tarfile without validating member paths against the target directory. A malicious environment_tarball can contain archive members with filenames using ".." directory traversal sequences, causing files to be written outside the intended extraction directory to arbitrary locations on the ML serving node filesystem. In multi-tenant or shared ML serving environments, this can lead to overwriting configuration files, writing SSH authorized_keys, or writing cron jobs for persistence. Exploitable by any user who can submit a model to the MLServer instance. Runtime-verified on the latest release. CVSS 9.9 Critical (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CWE-22 Path Traversal. Researcher: mohammad adnan (cystack.ps redteam). |
|---|
| Source | ⚠️ https://github.com/SeldonIO/MLServer/issues/2553 |
|---|
| User | Anonymous User |
|---|
| Submission | 09/15/2026 00:35 (28 days ago) |
|---|
| Moderation | 10/12/2026 13:58 (28 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416889 [SeldonIO MLServer up to 1.6.1 environment_tarball mlserver/env.py _extract_env path traversal] |
|---|
| Points | 20 |
|---|