Path Traversal Vulnerability in Xinference Product by Xinference AI

CVE-2026-112051

What is CVE-2026-112051?

Xinference 4.0.1 has a path traversal vulnerability that can be exploited by unauthenticated attackers. By using backslash sequences in the model_name parameter, attackers can write and delete arbitrary .json files. This allows them to register a malicious custom model through the model registration endpoint, potentially overwriting critical configuration or data files accessible to the Xinference process. It is essential for users to apply patches and mitigate this risk to the integrity of their applications.

References