CVE-2026-5535 | FedML-AI FedML up to 0.8.9 MQTT Message FileUtils.java dataSet path traversal

A vulnerability identified as critical has been detected in FedML-AI FedML up to 0.8.9. This impacts an unknown function of the file FileUtils.java of the component MQTT Message Handler. Performing a manipulation of the argument dataSet results in path traversal.

This vulnerability is reported as CVE-2026-5535. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.