CVE-2026-109156

A flaw was found in MLServer. A remote attacker could achieve arbitrary file write by supplying a specially crafted environment archive containing path traversal sequences. Because the environment extraction handler does not adequately validate destination paths before unpacking, archive files ca...