NVIDIA Triton Inference Server is susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to access restricted files on the host system.

This is a path traversal flaw (CWE-22) that permits an unauthenticated attacker to manipulate file paths, potentially leading to unauthorized information disclosure.

The ability to perform path traversal poses a severe risk to data confidentiality and system integrity. With a CVSS score of 7.5 (High), this vulnerability could be leveraged to exfiltrate sensitive configuration files or model data, resulting in significant security and compliance exposure.

Immediate Action: Upgrade all instances of NVIDIA Triton Inference Server to version r26.03 or later.

Proactive Monitoring: Review web server and application logs for suspicious directory traversal patterns, such as sequences like "../" in URI requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block path traversal attempts.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of path traversal attacks, organizations must treat this as a high-priority update. Ensure that all affected servers are patched to version r26.03 immediately to prevent potential data breaches.