Multi Model Server EUVD-2026-109111

Requires the attacker to supply a crafted model archive to a Multi Model Server instance that extracts it (model registration/load path), exploiting a CWE-23 relative path traversal during extraction to write files outside the model directory and achieve code execution. The CVSS vector states no authentication (PR:N) and no user interaction (UI:N), consistent with MMS's model-registration API accepting archives. The key LIMITING factor is network reachability of that registration/management endpoint: MMS's management API has historically bound to localhost by default, so remote unauthenticated exploitation realistically depends on the endpoint being exposed on a reachable interface or the attacker being able to influence the model source. There is NO patched version (product is end-of-life), so the only complete mitigation per the vendor is to discontinue use and migrate to a supported model-serving solution.

Severity signals are strong and internally consistent: AWS (AMZN) assigned CVSS 4.0 9.3 (Critical) with AV:N/AC:L/AT:N/PR:N/UI:N and high confidentiality, integrity and availability impact, matching a CWE-23 relative path traversal that yields arbitrary code execution. The vuln.today decision label is act_now, reinforcing high urgency. However, several exploitation signals are MISSING rather than negative: no EPSS probability was provided, the input shows no CISA KEV listing (so this is not confirmed as actively exploited), and no PoC or exploit reference is supplied - so there is no public exploit identified at time of analysis. The most important caveat is a likely mismatch between the AV:N/PR:N scoring and real-world reachability: Multi Model Server's management API (used to register model archives) has historically bound to localhost by default, so network-unauthenticated exploitation realistically requires the management/registration endpoint to be exposed to attackers - verify exposure before treating every instance as internet-exploitable. Net assessment: a genuinely high-severity, unauthenticated-RCE-class flaw that is a real priority for anyone still running MMS, but exploitation prevalence cannot be confirmed from the provided data, and the product is end-of-life with NO fixed version available, so risk persists until the product is removed.

An attacker who can reach a Multi Model Server registration/management endpoint supplies a crafted model archive (.mar) whose entries contain relative path traversal sequences; when MMS extracts the archive it writes files outside the intended model directory, overwriting a script or executable that the server later runs, resulting in arbitrary code execution on the host. No public PoC or exploit code was provided in the input, and the attack is rated AC:L (low complexity) with no authentication or user interaction required per the CVSS vector.