title: CVE
description: NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
problem types: CWE-23
affected:
{
defaultStatus: unaffected
product: Triton Inference Server
vendor: nvidia
versions:
status: affected, version: All versions prior to 2.40
}
metrics:
cvssV3_1: [
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL