Path Traversal Vulnerability in SeldonIO MLServer Environment Handler

CVE-2026-109156

What is CVE-2026-109156?

A security vulnerability has been identified in SeldonIO MLServer affecting versions up to 1.6.1. This flaw arises within the _extract_env function located in the mlserver/env.py file, specifically linked to the environment_tarball handler. By exploiting this vulnerability, an attacker could execute a path traversal attack remotely, potentially exposing sensitive files or directories on the server. The vendor has been notified about this issue but has not provided a response or remediation steps.

References