CVE-2026-65164: Path Traversal
NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to arbitrary file creation or overwrite, code execution, information disclosure, data tampering, and denial of service.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates no privileges are required and no user interaction is required, but the attacker must be able to submit a dSort job containing crafted archive member names.
Is this limited to a local attack surface?
No. The vulnerability is remotely exploitable through the dSort archive extraction component.
How difficult is exploitation expected to be?
The CVSS vector rates attack complexity as high. No further conditions needed to satisfy that complexity rating are provided.