NVIDIA AIStore for Linux implements a dSort archive extraction component that permits users to supply archived member names. A remote attacker can craft archive entries that traverse directories outside the intended extraction location, leading to the creation or overwriting of arbitrary files. Successful exploitation can enable code execution, information disclosure, data tampering, and denial of service. The weakness corresponds to CWE-22, a path traversal defect.

The vulnerability affects the NVIDIA AIStore framework on Linux platforms. No specific version range is provided, so any deployment using the dSort component is potentially impacted.

The CVSS score of 8.1 indicates a high severity of remote misuse. Current EPSS information is unavailable, and the vulnerability has not been catalogued by CISA KEV. The likely attack vector is remote, supplied by a crafted archive within a dSort job, making it infeasible for local users without dSort access. Exploitation would require the attacker to trigger the extraction process, which may be exposed over the network to authenticated or unauthenticated users depending on the deployment configuration.