CVE-2026-24217
Path Traversal in NVIDIA BioNeMo Core for Linux
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: NVIDIA Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nvidia | bionemo_core | From 2026-05-20 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-29 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24217 is a vulnerability in NVIDIA BioNeMo Core for Linux that allows a user to perform a path traversal by loading a malicious file.
This path traversal weakness (CWE-29) enables an attacker to access files and directories outside the intended scope, potentially leading to unauthorized actions.
Exploitation of this vulnerability could result in code execution, denial of service, information disclosure, and data tampering.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in NVIDIA BioNeMo Core for Linux allows for path traversal leading to potential code execution, denial of service, information disclosure, and data tampering.
Such impacts—especially information disclosure and data tampering—could negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.
However, the provided context and resources do not explicitly discuss or analyze the effects of this vulnerability on compliance with these standards.
How can this vulnerability impact me? :
If exploited, this vulnerability can have severe impacts including:
- Code execution - an attacker could run arbitrary code on the affected system.
- Denial of service - the system or application could be made unavailable.
- Information disclosure - sensitive data could be exposed to unauthorized users.
- Data tampering - data integrity could be compromised by unauthorized modifications.