SeldonIO CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM SeldonIO CVE published 2026-10-13

CVE-2026-109156

A path traversal vulnerability exists in SeldonIO MLServer versions up to 1.6.1, specifically in the _extract_env function of the mlserver/env.py file within the environment_tarball handler. This issue allows remote attackers to manipulate the environment variables by exploiting the path traversal weakness. The vendor, SeldonIO, was contacted but did not respond.