Is there a public PoC exploit available for CVE-2026-5535?

Yes, a public proof-of-concept exploit is available for CVE-2026-5535. Prioritise patching immediately. EPSS: 0.0%.

Java CVE-2026-5535

Q: What is the CVSS score of CVE-2026-5535?

CVE-2026-5535 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19017 LOW

Path Traversal (CWE-22)

2026-04-05 VulDB

GHSA-x5gq-6962-7gv9

Path Traversal Java Fedml

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 05, 2026 - 02:45 euvd

EUVD-2026-19017

Analysis Generated

Apr 05, 2026 - 02:45 vuln.today

CVE Published

Apr 05, 2026 - 02:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in FedML-AI FedML up to 0.8.9. This impacts an unknown function of the file FileUtils.java of the component MQTT Message Handler. Performing a manipulation of the argument dataSet results in path traversal. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in FedML-AI FedML up to version 0.8.9 allows authenticated remote attackers to read arbitrary files via manipulation of the dataSet argument in the MQTT Message Handler (FileUtils.java component). The vulnerability has a CVSS score of 4.3 and publicly available exploit code exists; however, it requires low-privilege authentication and provides only information disclosure without modification or availability impact. The vendor did not respond to early disclosure efforts.

Technical ContextAI

The vulnerability resides in the MQTT Message Handler component of FedML, specifically in the FileUtils.java file. It is a classic path traversal flaw (CWE-22) where user-supplied input via the dataSet parameter is not properly sanitized before being used in file path operations. The MQTT protocol is used for message handling in distributed machine learning scenarios, and the lack of input validation allows attackers to traverse directory structures using path manipulation techniques (such as ../ sequences) to access files outside the intended directory scope. FedML is an open-source federated learning framework written in Java, commonly deployed in machine learning infrastructure environments.

RemediationAI

Organizations should upgrade FedML to a version later than 0.8.9 if available; however, specific patched version numbers are not confirmed in the vendor advisory data. Immediately review and restrict authentication credentials for FedML systems, especially in environments with untrusted users. As a temporary workaround pending upgrades, implement network-level access controls to restrict MQTT traffic to only trusted sources and isolate FedML systems on separate network segments. Input validation should be enforced at the application level to reject path traversal sequences in the dataSet parameter. Reference the VulDB entries (https://vuldb.com/vuln/355288) for additional technical details and monitoring guidance.