Mlserver
Monthly
Path traversal in SeldonIO MLServer up to and including 1.6.1 allows an attacker who can supply or influence a custom environment tarball to write files outside the intended extraction directory, because _extract_env in mlserver/env.py does not sanitize '../' entries in archive member names. The behavior is reachable remotely only when the model's environment_tarball feature is in use and a crafted archive is delivered to the extraction routine; in most deployments that means some form of model-artifact or upload access rather than truly anonymous access, even though the published CVSS 4.0 vector claims PR:N with UI:P (extraction must be triggered). This is a single-source VulDB disclosure, no public exploit code has been identified at time of analysis, no CISA KEV entry exists, and the vendor was contacted but did not respond, so no vendor-confirmed fix version is available.
Path traversal in SeldonIO MLServer up to and including 1.6.1 allows an attacker who can supply or influence a custom environment tarball to write files outside the intended extraction directory, because _extract_env in mlserver/env.py does not sanitize '../' entries in archive member names. The behavior is reachable remotely only when the model's environment_tarball feature is in use and a crafted archive is delivered to the extraction routine; in most deployments that means some form of model-artifact or upload access rather than truly anonymous access, even though the published CVSS 4.0 vector claims PR:N with UI:P (extraction must be triggered). This is a single-source VulDB disclosure, no public exploit code has been identified at time of analysis, no CISA KEV entry exists, and the vendor was contacted but did not respond, so no vendor-confirmed fix version is available.