SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.
The vulnerability results from improper sanitization of the filename submitted by the user to specific server endpoints. The attacker places '../' sequences in the uploaded filename, allowing escape from the intended target directory. As a result, the file can be written to any location in the file system to which the server process has write permissions — without requiring any authentication.
An attacker can write arbitrary files to unauthorized locations on the server, enabling overwriting of critical configuration files, deployment of malicious code, or destabilization of system operations. The vulnerability directly threatens server integrity and availability.
Apply patches available from the vendor according to the references. As a temporary workaround, it is recommended to restrict network access to SGLang endpoints exclusively to trusted hosts and run the server process with minimal write permissions in the file system.
Lmsys SGLang — versions indicated in vendor references
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HLmsys Sglang
APPLmsys0.5.10
Related vulnerabilities
RCE przez niebezpieczną deserializację pickle w SGLang (ładowanie wag modeli)
SGLang: nieuwierzytelnione RCE przez podatność deserializacji pickle
RCE w SGLang — ucieczka z sandbox przez podsystem dumper
SGLang: nieuwierzytelnione RCE przez deserializację pickle w ZeroMQ
RCE w SGLang przez niebezpieczną deserializację pickle na gnieździe ROUTER