CVE-2026-112051 in inference
Summary
by MITRE • 10/18/2026
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1/model_registrations/{model_type} with names like ..\..\evil to overwrite configuration or data files writable by the Xinference process.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified within Xinference versions up to 4.0.1 represents a critical path traversal flaw that specifically impacts Windows-based deployments of the platform. This security defect arises from insufficient sanitization of user-supplied input, particularly in the model_name parameter utilized during custom model registration processes. The core technical failure lies in the application's handling of directory separators, where backslash sequences are not adequately validated or normalized before being processed by the underlying file system operations. In Windows environments, the backslash character serves as a standard path separator, and its misuse can allow an attacker to traverse up the directory tree from the intended target location. This lack of input validation enables unauthenticated actors to manipulate file paths significantly beyond their authorized scope, leading to unauthorized read, write, or delete access on arbitrary files accessible by the Xinference process user account.
From a technical perspective, the exploitation vector involves interacting with the POST /v1/model_registrations/{model_type} endpoint. An attacker can craft a request where the model_name field contains malicious path traversal sequences such as ..\..\evil. When the application processes this input to register or update a custom model configuration, it fails to strip or escape these directory navigation characters. Consequently, instead of creating or modifying files within the designated models directory, the system writes data to locations specified by the attacker's relative paths. This capability allows for the overwriting of critical JSON configuration files and other data structures that govern the behavior and state of the Xinference service. The severity is compounded by the fact that this operation requires no authentication, making it accessible to any network user who can reach the API endpoint.
The operational impact of this vulnerability extends beyond simple file manipulation. By overwriting configuration or data files, an attacker can potentially alter how models are loaded, executed, or managed within the Xinference environment. This could lead to service disruption if critical configuration files are corrupted or deleted. More critically, since JSON files often contain settings that influence runtime behavior, malicious modifications might facilitate further attacks such as privilege escalation if the application runs with elevated privileges, or it could serve as a precursor to remote code execution depending on how these modified configurations are subsequently processed by other components of the system. The ability to delete arbitrary files also poses a significant risk to data integrity and availability, potentially causing denial-of-service conditions for legitimate users relying on specific models or settings.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can cause files to be located outside of the intended directory. Furthermore, in terms of tactical classification under the MITRE ATT&CK framework, this activity corresponds to T1564: Host File System Attribute Modification and potentially T1083: File and Directory Discovery if used for reconnaissance prior to modification. The exploitation method also reflects aspects of CWE-73: External Control of File Name or Path, highlighting the failure to validate external inputs before using them in file system operations.
To mitigate this vulnerability, immediate remediation should focus on upgrading Xinference to a version greater than 4.0.1 where these path traversal issues have been addressed by developers through improved input validation and normalization techniques. For systems that cannot be immediately upgraded, implementing strict allow-listing of characters for the model_name parameter is essential, ensuring that only alphanumeric characters, hyphens, and underscores are accepted while rejecting any sequence containing dots or backslashes. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking path traversal patterns in API requests can provide an additional layer of defense. It is also recommended to run the Xinference service under a least-privilege user account that has minimal permissions on the file system, thereby limiting the potential damage even if exploitation occurs. Regular auditing of configuration files and monitoring for unexpected changes to JSON data structures can aid in early detection of such attacks.