Description

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-18T19:16:52.650Z",
  "pubdate": "2026-08-18T19:16:52.650Z",
  "executiveSummary": "An absolute path traversal vulnerability has been identified in the NVIDIA Triton Inference Server for Linux. This security flaw arises from insufficient validation of user-supplied input paths within the affected product.\nA successful exploitation of this vulnerability allows a malicious actor to traverse the filesystem using absolute paths, potentially leading to arbitrary code execution within the context of the running service.\nThe affected system is the NVIDIA Triton Inference Server running on Linux environments. The risk implications are severe, as unauthorized execution of arbitrary code can compromise the integrity, confidentiality, and availability of the host system and deployed machine learning models.\nTo execute this attack, a malicious actor requires network access to the Triton Inference Server interface that processes the vulnerable input paths. Depending on the specific deployment configuration, authentication may or may not be required to interact with the vulnerable component.\nOrganizations utilizing the NVIDIA Triton Inference Server on Linux should immediately review their exposure and apply available vendor patches or hardening measures to prevent unauthorized filesystem access and potential remote code execution scenarios.",
  "technicalDetails": "The vulnerability is classified as an absolute path traversal flaw residing within the input processing mechanisms of the NVIDIA Triton Inference Server for Linux.\nThe root cause of the issue stems from the application's failure to properly sanitize and restrict file path inputs, allowing sequences or absolute paths such as root-directed paths to bypass intended directory containment boundaries.\nWhen a client supplies a specially crafted payload containing absolute path specifiers, the vulnerable component fails to validate whether the target resource resides within the designated secure working directory. Consequently, the underlying file handling routines resolve the path globally across the host filesystem.\nThe attack flow typically proceeds as follows: First, the attacker identifies an input vector within the NVIDIA Triton Inference Server that handles file paths or model artifacts. Second, the attacker crafts a malicious request embedding an absolute path traversal sequence targeting sensitive system binaries, configuration files, or writable execution directories. Third, the server processes the input without adequate sanitization, granting read or write access outside the intended sandbox. Finally, by leveraging this unauthorized file read/write capability in conjunction with other secondary weaknesses or direct artifact replacement, the attacker achieves arbitrary code execution on the host operating system.\nThe vulnerable component involves the internal file resolution and loading logic of the NVIDIA Triton Inference Server. The issue specifically impacts Linux deployments of the product.\nPrivilege and authentication requirements depend on the specific API endpoint exposed and the deployment architecture, but internal or external network exposure of the inference server facilitates remote exploitation.\nPost-exploitation impact includes unauthorized access to sensitive system files, potential overwriting of critical binaries or libraries, and subsequent remote code execution with the privileges of the Triton Inference Server process."
}