CVE-2026-5535
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
FedML-AI FedML versions up to 0.8.9 contain a path traversal vulnerability in the MQTT Message Handler component in FileUtils.java. An attacker can remotely manipulate the dataSet argument, leading to access to files outside the allowed directory.
Risk Assessment
An attacker can remotely read or write files outside the allowed directory, potentially leading to data leakage or further privilege escalation.
Recommendation
Upgrade FedML to a version newer than 0.8.9 if available, or apply temporary mitigations such as path validation.
Original NVD description (English source)
A security flaw has been discovered in FedML-AI FedML up to 0.8.9. This impacts an unknown function of the file FileUtils.java of the component MQTT Message Handler. Performing a manipulation of the argument dataSet results in path traversal. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.