Technical impact
NVIDIA Flare SDK has an improper input validation flaw that allows an attacker to perform path traversal. This could enable the attacker to read files outside the intended directory, potentially leaking sensitive information. The weakness is categorized as CWE‑20, indicating untrusted data used in file path construction.
Affected Systems
Vendors affected include NVIDIA, specifically products using the Flare SDK. No specific version numbers are disclosed in the available data, so all installations of the Flare SDK should be evaluated for the presence of the flaw.
Risk and Exploitability
The CVSS v3.1 score of 6.5 indicates a moderate severity. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attacker could potentially exploit this flaw if an input channel to the SDK can be controlled, most likely through user‑supplied data or a network request. The impact is limited to information disclosure; no remote code execution or denial‑of‑service is indicated.
