CVE-2023-31036

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23 CWE-22

Affected software

Vendor	Product	Versions
nvidia	Triton Inference Server	All versions prior to 2.40

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5509Vendor Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5509Vendor Advisory

Timeline

Published: Jan 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-310377.2NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network cal CVE-2023-310388.8SQL injection in Log4cxx when using the ODBC appender to send log messages to a database. No fields sent to the database were properly esca CVE-2023-310399.8Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An att CVE-2023-31047.5Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack CVE-2023-310417.5An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information could optionally be s CVE-2023-310424.3A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availabili CVE-2023-310437.5EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used wi CVE-2023-310448.8An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaig CVE-2023-310454.8A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitr CVE-2023-310466.5A Path Traversal vulnerability exists in PaperCut NG before 22.1.1 and PaperCut MF before 22.1.1. Under specific conditions, this could pote CVE-2023-310479.8In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to uploa CVE-2023-310485.3The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely.