The vulnerability is a path traversal flaw in NVIDIA AIStore for Linux’s target‑side object rename handler. An unauthenticated remote attacker can submit a malicious rename destination that bypasses directory restrictions, resulting in the arbitrary creation or overwrite of a file. This flaw can give the attacker code execution capabilities, privilege escalation, data tampering, information disclosure, and denial of service. The weakness is a classic pathname traversal flaw (CWE‑22).

NVIDIA AIStore framework for Linux. No specific product version details are provided, so any installed instance of the AIStore framework is potentially vulnerable.

With a CVSS score of 8.1, the vulnerability is considered high severity. EPSS data is not available, so the exact likelihood of exploitation cannot be quantified, but the lack of a KEV listing suggests no widespread active exploitation yet. The attack vector is likely over the network, where an unauthenticated user can reach the rename API exposed by AIStore. If exploited, an attacker could execute arbitrary code on the target host, elevate privileges, or tamper with critical data.