The _extract_env function in SeldonIO MLServer’s environment_tarball handler processes archives by resolving paths without normalizing them, creating a classic path traversal vulnerability. An attacker able to supply a specially crafted tarball can cause the handler to extract files outside the intended working directory, potentially reading sensitive files or facilitating additional compromise. The flaw exists in all releases up to version 1.6.1.

SeldonIO MLServer, versions 1.6.1 and earlier, that expose the environment_tarball handler to external input. Any deployment that allows untrusted tarball uploads or manual extraction via _extract_env may be at risk. The vendor has not yet published a fix, and the issue remains open on the project’s issue tracker.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is currently available and the vulnerability is not listed in CISA KEV. The description specifies that the attack can be performed from remote, but no publicly known exploit code is documented. The primary risk is that an attacker can read or write arbitrary files on the host, potentially exposing or corrupting data. Monitoring for anomalous extraction attempts and blocking offending sources is advisable until a vendor update is released.