CVE-2026-115812 in Multi Model Server
Summary
by MITRE • 10/23/2026
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.
Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in Amazon Web Services Multi Model Server versions 1.1.11 and earlier represents a critical security flaw rooted in improper handling of file paths during the extraction process of model archives. This issue is classified as an arbitrary code execution vector facilitated by relative path traversal, technically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core technical failure lies in the server's logic when unpacking compressed archive files submitted for inference or deployment. When a remote actor submits a maliciously crafted model archive, they can manipulate the internal file paths within that archive to include directory traversal sequences such as dot-dot-slash characters. Because the extraction routine fails to adequately sanitize these inputs or validate them against the intended target directory structure, it allows files to be written outside of the designated sandboxed environment where models are typically stored and executed.
This lack of input validation creates a direct pathway for remote code execution. By exploiting this path traversal weakness, an attacker can overwrite critical system binaries, configuration files, or library dependencies located in directories with higher privilege levels than the model storage area. Once these essential components are replaced with malicious payloads controlled by the attacker, subsequent operations performed by the Multi Model Server process will execute the injected code rather than legitimate functionality. This effectively grants the remote actor full control over the underlying host system running the inference service, bypassing standard isolation mechanisms intended to contain model execution within a secure boundary. The severity of this flaw is compounded by its potential for automated exploitation, as crafting such archives requires minimal complexity compared to more sophisticated buffer overflow or logic-based attacks.
The operational impact of this vulnerability extends beyond simple data compromise to encompass complete system takeover and service disruption. An attacker leveraging this flaw could exfiltrate sensitive training data or proprietary model weights stored on the server, leading to significant intellectual property loss. Furthermore, they could establish persistent backdoors, install cryptomining software, or use the compromised instance as a pivot point for lateral movement within the broader network infrastructure. Since Multi Model Server is designed to handle untrusted inputs from various clients in many deployment scenarios, this vulnerability exposes organizations running inference workloads on affected versions to high-risk exposure without requiring authentication if the endpoint is publicly accessible or improperly secured via other means.
Given that Amazon Web Services has declared Multi Model Server end of life and no patched version exists for these legacy releases, remediation through software updates is not an option. The primary mitigation strategy requires immediate discontinuation of use for any production environments still relying on versions 1.1.11 or earlier. Organizations must migrate their model serving workloads to supported alternatives such as AWS SageMaker JumpStart, Amazon EKS with custom containers utilizing updated inference frameworks like TorchServe or TensorFlow Serving, which receive regular security patches and adhere to current best practices for input validation and sandboxing. Until migration is complete, strict network-level controls should be implemented to restrict access to the Multi Model Server endpoints, ensuring that only trusted internal services can submit model archives, thereby reducing the attack surface available to remote actors attempting to exploit this path traversal flaw.