EUVD-2026-71124
GHSA-xhf8-q5pf-vp28
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No authentication required, network-accessible endpoint; confidentiality-only impact constrained to specific filenames at attacker-supplied paths, no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model_path parameter without authentication or path confinement. The endpoint reads and parses config.json, tokenizer_config.json, and chat_template.jinja files at the supplied path and reflects the parsed content back to the caller, allowing an unauthenticated attacker to probe the server filesystem and extract content of files with those names in any directory.
AnalysisAI
Unauthenticated arbitrary-path file read in Xinference v3.x (including commit 4a94832 and v3.3.0) exposes server filesystem content to any network-accessible attacker via the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a caller-supplied model_path without authentication or path validation, reads config.json, tokenizer_config.json, and chat_template.jinja from that path, and reflects the parsed content in the HTTP response. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond network connectivity to the Xinference API port are required - the endpoint performs no authentication check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) is well-calibrated: exploitation requires only a crafted HTTP POST request with no authentication or precondition, and the confidentiality impact is high given that config.json files frequently contain API keys, database credentials, or model registry tokens. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Xinference deployments running v3.3.0 or other v3.x versions and confirm which are internet-accessible; audit CloudTrail/access logs for POST requests to /v1/models/llm/auto-register. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Xorbits Inference (Xinference) 2.5.0 and earlier lets a remote attacker run arbitrary OS comman
Remote code execution in Xinference (all versions before 2.12.0) allows any user with model-launch access to execute arb
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today