CVE-2026-5535 - Vulnerability Details

- FedML-AI FedML MQTT Message FileUtils.java path traversal

Description

A security flaw has been discovered in FedML-AI FedML up to 0.8.9. This impacts an unknown function of the file FileUtils.java of the component MQTT Message Handler. Performing a manipulation of the argument dataSet results in path traversal. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-04-05

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in FileUtils.java within the MQTT message handling component of FedML-AI FedML. By manipulating the argument dataSet, an attacker can perform a path traversal attack, enabling reading or writing of files outside the intended directory. This weakness can compromise confidentiality and integrity of the system’s files and configuration.

Affected Systems

FedML-AI’s FedML product, versions up to and including 0.8.9, is affected. No further version details are supplied.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS information is missing, and the vulnerability is not listed in the CISA KEV catalog. The description explicitly states the attack is possible remotely, likely via an MQTT interface that accepts a dataset parameter. An attacker who can send crafted MQTT messages could exploit the path traversal to gain unauthorized file access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FedML-AI

FedML

affected

Version	Status	Constraints
`0.8.0`	affected	—
`0.8.1`	affected	—
`0.8.2`	affected	—
`0.8.3`	affected	—
`0.8.4`	affected	—
`0.8.5`	affected	—
`0.8.6`	affected	—
`0.8.7`	affected	—
`0.8.8`	affected	—
`0.8.9`	affected	—

Configuration 1 [-]

cpe:2.3:a:tensoropera:fedml:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Fedml-ai

Fedml

100%

Version	Status	Scheme	Platform
`0.8.0`	affected	semver	—
`0.8.1`	affected	semver	—
`0.8.2`	affected	semver	—
`0.8.3`	affected	semver	—
`0.8.4`	affected	semver	—
`0.8.5`	affected	semver	—
`0.8.6`	affected	semver	—
`0.8.7`	affected	semver	—
`0.8.8`	affected	semver	—
`0.8.9`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a version later than 0.8.9 if one exists.
If an upgrade is unavailable, isolate the affected host from external MQTT traffic using firewall rules or network segmentation.
Implement server‑side input validation to reject dataset arguments containing path traversal sequences.
Monitor MQTT logs for anomalous requests attempting to access protected files.
Check the vendor’s site or security advisories regularly for a future patch.

Generated by OpenCVE AI on April 5, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00044.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/AnalogyC0de/public_exp/issues/25
https://vuldb.com/submit/782200
https://vuldb.com/vuln/355288
https://vuldb.com/vuln/355288/cti

History

Thu, 30 Apr 2026 19:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tensoropera Tensoropera fedml
CPEs		cpe:2.3:a:tensoropera:fedml::::::::
Vendors & Products		Tensoropera Tensoropera fedml

Tue, 07 Apr 2026 00:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fedml-ai Fedml-ai fedml
Vendors & Products		Fedml-ai Fedml-ai fedml

Mon, 06 Apr 2026 16:45:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 05 Apr 2026 03:15:00 +0000

Type	Values Removed	Values Added
Description		A security flaw has been discovered in FedML-AI FedML up to 0.8.9. This impacts an unknown function of the file FileUtils.java of the component MQTT Message Handler. Performing a manipulation of the argument dataSet results in path traversal. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title		FedML-AI FedML MQTT Message FileUtils.java path traversal
Weaknesses		CWE-22
References		https://github.com/AnalogyC0de/public_exp/issues/25 https://vuldb.com/submit/782200 https://vuldb.com/vuln/355288 https://vuldb.com/vuln/355288/cti
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Fedml-ai Fedml

Tensoropera Fedml

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-04-05T02:00:17.300Z

Updated: 2026-04-06T15:36:13.025Z

Reserved: 2026-04-04T06:40:45.888Z

Link: CVE-2026-5535

Vulnrichment

Updated: 2026-04-06T15:36:08.675Z

NVD

Status : Analyzed

Published: 2026-04-05T03:16:01.700

Modified: 2026-04-30T19:29:38.243

Link: CVE-2026-5535

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-06T21:57:19Z

Weaknesses

CWE-22

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object