The vulnerability arises from the software's handling of model configuration files that include archives (e.g., .tar files). These archives are automatically extracted without proper validation, allowing an attacker to perform a 'tarslip' attack. This can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution (RCE) if the attacker overwrites critical backend assets.

An attacker crafts a malicious .tar archive containing a symlink that points to a sensitive directory. By uploading this archive through the model configuration, the attacker can write files to arbitrary locations on the server. For example, overwriting a backend asset used by a model can lead to remote code execution when the model is run.

Users running version 2.17.1 of the software who allow model configurations that include archives are affected. This includes any deployment where the software has write permissions to critical directories.