| 标题 | SeldonIO MLServer 1.6.1 Path Traversal |
|---|
| 描述 | MLServer (Seldon / SeldonIO) up to 1.6.1 is vulnerable to path traversal (CWE-22) in the _extract_env() function in mlserver/env.py during model environment setup. When a model repository contains an environment_tarball, MLServer extracts it using tarfile without validating member paths against the target directory. A malicious environment_tarball can contain archive members with filenames using ".." directory traversal sequences, causing files to be written outside the intended extraction directory to arbitrary locations on the ML serving node filesystem. In multi-tenant or shared ML serving environments, this can lead to overwriting configuration files, writing SSH authorized_keys, or writing cron jobs for persistence. Exploitable by any user who can submit a model to the MLServer instance. Runtime-verified on the latest release. CVSS 9.9 Critical (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). CWE-22 Path Traversal. Researcher: mohammad adnan (cystack.ps redteam). |
|---|
| 来源 | ⚠️ https://github.com/SeldonIO/MLServer/issues/2553 |
|---|
| 用户 | Anonymous User |
|---|
| 提交 | 2026-09-15 00時35分 (28 日前) |
|---|
| 管理 | 2026-10-12 13時58分 (28 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 416889 [SeldonIO MLServer 直到 1.6.1 environment_tarball mlserver/env.py _extract_env 目录遍历] |
|---|
| 积分 | 20 |
|---|