PT-2026-30406 · Fedml Ai · Fedml

Ana10Gy · Published 2026-04-05 · Updated 2026-04-05 · CVE-2026-5535

Mitre

CVSS v3.1

4.3

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A security flaw has been discovered in FedML-AI FedML up to 0.8.9. This impacts an unknown function of the file FileUtils.java of the component MQTT Message Handler. Performing a manipulation of the argument dataSet results in path traversal. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-5535

Affected Products

Fedml

References · 8

• 🔥 https://github.com/AnalogyC0de/public_exp/issues/25 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5535 · Security Note
• https://twitter.com/CVEnew/status/2040649514634084450 · Twitter Post
• https://vuldb.com/vuln/355288 · Note
• https://vuldb.com/vuln/355288/cti · Note
• https://twitter.com/cyberbivash/status/2040640563309928579 · Twitter Post
• https://vuldb.com/submit/782200 · Note
• https://twitter.com/infoflowcloud/status/2040650782207365169 · Twitter Post