Description

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T19:16:50.840Z",
  "pubdate": "2026-08-18T19:16:50.840Z",
  "executiveSummary": "An absolute path traversal vulnerability has been identified within the NVIDIA Triton Inference Server for Linux. This security flaw arises from insufficient validation of user-supplied input paths within the affected software components. A remote or locally authenticated attacker capable of interacting with the inference server can leverage this weakness to manipulate file read or write operations outside of the intended directory structure.\nThe primary impact of a successful exploitation includes potential arbitrary code execution and unauthorized information disclosure. By supplying specially crafted absolute path sequences, an attacker may access sensitive system files or overwrite critical binaries, thereby compromising the integrity, confidentiality, and availability of the host system running the Triton Inference Server.\nThe affected product is the NVIDIA Triton Inference Server running on Linux operating systems. The risk implications are severe due to the potential for complete system compromise and unauthorized access to proprietary model data or system configuration files. Exploitation typically requires the ability to submit requests or interact with vulnerable endpoints exposed by the inference service.",
  "technicalDetails": "The vulnerability is classified as an absolute path traversal flaw. The root cause stems from the application accepting raw, unvalidated file paths or failing to properly sanitize inputs that designate absolute directory locations (e.g., paths starting with a leading slash '/' on Linux systems) when processing internal file operations.\nIn a standard attack flow, the adversary crafts a malicious payload containing absolute path specifiers designed to bypass application-level containment boundaries. When the vulnerable Triton component processes this input without adequate normalization or confinement checks, it treats the supplied path as an absolute reference on the underlying Linux filesystem rather than a relative path restricted to a designated sandbox or working directory.\nDuring exploitation, the software attempts to read from or write to the targeted absolute file path specified in the payload. Depending on the specific functionality abused, information disclosure occurs if the application reads sensitive system files (such as /etc/passwd or configuration files containing credentials) and inadvertently returns their contents through inference responses, logs, or error messages. Conversely, code execution can be achieved if the path traversal primitive allows the adversary to overwrite executable binaries, shared libraries, or startup scripts that are subsequently executed by the application or the underlying operating system.\nThe vulnerable component resides within the file handling or resource loading sub-systems of the NVIDIA Triton Inference Server for Linux. The attack surface relies on the exposure of services that accept file path parameters or model repository configurations. While specific authentication and privilege requirements depend on the deployment configuration and network exposure of the Triton instance, any operational context allowing untrusted inputs to influence file resolution routines exposes the system to this traversal vector."
}