CVE-2026-109156: SeldonIO MLServer environment_tarball env.py _extract_env path traversal
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function extractenv of the file mlserver/env.py of the component environmenttarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication or local access?
The issue is remotely exploitable over the network and does not require prior privileges. The supplied vector indicates user interaction is required.
Which installations should be treated as affected?
SeldonIO MLServer versions up to and including 1.6.1 are identified as affected, specifically where the environment_tarball handler is in use.
What is the expected security impact?
The provided severity vector rates confidentiality, integrity, and availability impact as low. The vulnerability is classified as path traversal.
Is a vendor fix or mitigation documented?
No fixed version or mitigation is provided in the available data. The vendor was contacted but did not respond to the disclosure.