NVIDIA Triton Inference Server for Linux has an absolute path traversal vulnerability (CWE-36). An attacker able to influence the server’s file path handling could read or potentially overwrite arbitrary files on the host, which may lead to code execution if the server processes those files. The description states that a successful exploitation could result in code execution, though the extent of the impact depends on the server’s configuration and the permissions of the Triton process.

The affected product is NVIDIA Triton Inference Server for Linux. No specific version information is given, so any deployment of this server that has not been confirmed patched by NVIDIA would be at risk.

The CVSS score of 5.5 indicates moderate overall risk. EPSS data are not available, and the vulnerability is not listed in CISA’s KEV catalog, so current exploit probability is unclear. Attackers would likely need to send a crafted inference request that includes a malicious file path; from the description, the exploitation path is not trivial, but the potential for code execution makes this a significant concern.