CVE-2026-47487: nvidia triton_inference_server Path Traversal

Vulnerability summary

CVE-2026-47487 is a high (CVSS 7.1) Path Traversal vulnerability in nvidia triton_inference_server. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.5% of scored vulnerabilities.

Timeline

1. 04-08-2026
   PublishedVulnerability first disclosed.
2. 04-08-2026
   Last modifiedVulnerability information updated.

Description

NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of service and information disclosure.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.