NVIDIA Triton Inference Server contains a path traversal vulnerability (CWE-22) in its model configuration upload functionality. This vulnerability allows an attacker to bypass pathname restrictions, potentially leading to unauthorized information disclosure or causing denial of service conditions. The issue affects all versions prior to r26.02. The CVSS 3.1 base score is 4.8 (medium), reflecting network attack vector with high attack complexity and no privileges or user interaction required. No official patch or remediation guidance has been provided by NVIDIA as of the published date.

Successful exploitation can lead to limited information disclosure and denial of service on affected Triton Inference Server instances. The vulnerability does not allow integrity or full availability compromise but can disrupt service and leak some information. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the NVIDIA vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Triton Inference Server and monitor for suspicious activity related to model configuration uploads. Avoid exposing the server to untrusted networks or users.