CVE-2026-109156

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109156

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109156.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109156

Published

2026-10-13T10:30:17Z

Modified

2026-10-15T02:47:21Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

SeldonIO MLServer environment_tarball env.py _extract_env path traversal

Details

A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109156.json"
}

References

Affected packages

Git / github.com/seldonio/mlserver

Affected ranges

Type

GIT

Repo

https://github.com/seldonio/mlserver

Events

Introduced

09637a8d618f70bbc23c3ed945bd4627b13419b1

Last Affected

0eeaa062f66e90360b9ff6c6c90d6188cd1d412e

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.6.0"
        },
        {
            "last_affected":  "1.6.0"
        },
        {
            "introduced":  "1.6.1"
        },
        {
            "last_affected":  "1.6.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*

1.6.0

1.6.1

1.6.1.rc1

1.6.1.rc2

Other

stable

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109156.json"