CVE-2026-112051

Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration

8.3 High

Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1/model_registrations/{model_type} with names like ....\evil to overwrite configuration or data files writable by the Xinference process.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: Low

Exploit likelihood

0.36%Unchanged since Oct 19, 2026

What each source reports

CVE List Score used 8.3

Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration

Record: CVE-2026-112051
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2026-103513 8.3

Record: EUVD-2026-103513
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xhc4-qrhj-p2jj 8.3

Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows...

Record: GHSA-xhc4-qrhj-p2jj
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness: CWE-22
Updated: 2026-11-02

NVD 8.3

Record: CVE-2026-112051
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Weakness: CWE-22
Updated: 2026-11-02

OSV 8.3

Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration

Record: CVE-2026-112051
CVSS 4.0: 8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness: CWE-22
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-112051 is a high vulnerability (CVSS 8.3) in Xorbits Inference, published October 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. No source names a fixed version.

References

Show 4 moreShow less