CVE-2026-109156 | SeldonIO MLServer up to 1.6.1 environment_tarball mlserver/env.py _extract_env path traversal (Issue 2553)

SecurityVulns
Yanac

A vulnerability labeled as critical has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler. Such manipulation leads to path traversal.

This vulnerability is listed as CVE-2026-109156. The attack may be performed from remote. There is no available exploit.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More