Xinference EUVD-2026-103513

The target must be a Windows host running Xinference ≤4.0.1, because the traversal relies on the backslash ('\') path separator - Linux/macOS deployments are not exploitable via this vector (reflected as AT:P). An attacker needs only network access to the registration endpoint and sends an unauthenticated POST /v1/model_registrations/{model_type} with a model_name containing backslash sequences like '..\..\evil'; no authentication (PR:N) or user interaction (UI:N) is required. Impact is limited to writing/deleting .json files in locations writable by the Xinference process, so the realistic blast radius depends on the service account's filesystem permissions.

Signals are moderately consistent and point to a real but conditional integrity risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation, and VI:H reflects the ability to overwrite configuration/data files; VC:N and VA:L correctly capture that there is no data disclosure and only limited availability impact (arbitrary .json deletion). The key mitigating signal is AT:P: exploitation requires the target to run on Windows, since the traversal depends on backslash path separators - Linux/macOS deployments (the common production case for inference servers) are not affected by this vector. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or at-scale exploitation; the finding originates from a VulnCheck advisory with a confirmed vendor patch. Net: this is a legitimate, patch-worthy integrity/persistence flaw for Windows-hosted Xinference instances, but the Windows-only precondition and absence of exploitation telemetry place it below a drop-everything priority for most fleets, which are Linux-based.

An attacker with network reach to a Windows-hosted Xinference server (≤4.0.1) sends an unauthenticated POST to /v1/model_registrations/{model_type} with a model_name such as '..\..\evil', causing the service to write or delete a .json file outside the model directory anywhere the Xinference process can write. By overwriting a configuration or persisted-model .json, the attacker can corrupt service state or plant attacker-controlled settings that persist across restarts. No public exploit code is identified at time of analysis, though the VulnCheck advisory and patch diff make the technique straightforward to reproduce.