CVE-2026-109156
SeldonIO MLServer environment_tarball env.py _extract_env path traversal
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 13, 2026
- Updated
- Oct 16, 2026
- Reserved
- Oct 12, 2026
Description
A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C | VulDB |
Weaknesses
- CWE-22 Path Traversal
Affected Products
| Product | Versions |
|---|---|
MLServerSeldonIO |
|
References
- VDB-416889 | SeldonIO MLServer environment_tarball env.py _extract_env path traversalvdb-entrytechnical-description
- VDB-416889 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-109156 | CVE Analysis and Reportthird-party-advisory
- Submit #978677 | SeldonIO MLServer 1.6.1 Path Traversalthird-party-advisory
- https://github.com/SeldonIO/MLServer/issues/2553issue-tracking
- https://github.com/SeldonIO/MLServer/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.