NVIDIA Triton Inference Server Path Traversal Allows Arbitrary File Read
Overview
A path traversal vulnerability was discovered in the NVIDIA Triton Inference Server, affecting its model loading mechanism via the control plane API. Triton allows models to be loaded from a local model repository on the server's filesystem. The vulnerability existed in the API endpoint used to request the loading of a new model version. The `model_name` parameter in the repository index request was not properly sanitized for directory traversal sequences (e.g., `../`). An authenticated attacker with privileges to manage models could send a request with a crafted `model_name` like `../../../../../../etc/passwd` to read arbitrary files from the server's filesystem. While this requires authentication, in many MLOps environments, CI/CD systems or less-privileged ML engineers have keys to this API, widening the attack surface. The impact of this vulnerability is significant information disclosure. An attacker could exfiltrate sensitive configuration files, source code, private keys, or other models stored on the server. This could serve as a stepping stone for further attacks, such as discovering credentials to pivot to other systems. NVIDIA addressed the vulnerability in a subsequent release by implementing stricter input validation and path canonicalization.
Affected Systems
Testing Guide
1. From a system with access to the Triton API, send a model load request using an API client or `curl`. 2. In the request, specify a `model_name` that includes a path traversal sequence pointing to a known file. Example POST to `/v2/repository/index`: ```json { "repository_path": "/path/to/models/../../../../etc/hostname" } ``` 3. If the server responds with the contents of the file (`hostname` in this case) instead of an error, it is vulnerable.
Mitigation Steps
1. Upgrade NVIDIA Triton Inference Server to version 2.65.0 or newer. 2. If upgrading is not immediately possible, restrict network access to the Triton server's management/API port (default 8001) to only trusted hosts. 3. Use a reverse proxy or Web Application Firewall (WAF) to inspect API requests and block any that contain path traversal sequences (`../`, `..\`) in the `model_name` field.
Patch Details
The vulnerability is fixed in NVIDIA Triton Inference Server version 2.65.0, released in December 2025.