Summary
NVIDIA Dynamo for Linux may improperly restrict pathnames supplied through multimodal requests. An attacker who can submit a crafted local path may cause the service to access or disclose information from locations outside the intended restricted directory.
Affected context
The vulnerability may occur in NVIDIA Dynamo for Linux when multimodal request processing accepts local path values and uses them to access server-side resources. Risk depends on the service exposing this request functionality and on pathname restrictions being enforced incompletely or inconsistently.
Exploit preconditions
- Attack surface: Multimodal request processing
- Required access: Ability to submit or influence a multimodal request containing a local path
- Trigger point: Server-side handling of the supplied pathname
- Why exploitation is possible: Insufficient restriction of the requested path may allow access beyond the intended directory boundary
Why this happens
The underlying bug is an insufficiently constrained server-side resource request. User-controlled path data is accepted by a component that is expected to limit access to a restricted directory, but the validation or canonicalization logic does not reliably preserve that boundary.
This maps to CWE-918: Server-Side Request Forgery, because attacker-influenced resource locations can cause the application to retrieve data from unintended server-side locations.
Potential impact
- An attacker may disclose files or other information outside the permitted directory
- Sensitive configuration or model data could be exposed
- The service may access resources that were not intended to be available through multimodal requests
- Repeated exploitation could increase the scope of information leakage
General mitigation guidance
Mitigation generally focuses on reducing trust in request-supplied paths and enforcing a strong server-side resource boundary.
Common defensive patterns include:
- Resolve and canonicalize paths before authorization checks
- Permit access only to explicitly allowlisted directories and resource types
- Prefer opaque resource identifiers over client-supplied filesystem paths
- Reject path values that resolve outside the intended directory
- Run request-processing services with least-privilege filesystem access
- Avoid exposing sensitive files to the service account
- Apply consistent validation at every code path that handles multimodal resources
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying request data used in filesystem or server-side resource access
- Code review checks for canonicalization performed after authorization or not performed at all
- Tests using boundary, normalized, and unexpected path inputs to verify directory confinement
- Runtime monitoring for requests that access unusual filesystem locations
- Policy enforcement that restricts service identities to approved directories
Automated security review tools may help identify user-controlled path flows, but findings should be validated against the deployment's actual resource model.
