Path Traversal Vulnerability in DeepInfer by DeepSeek AI
CVE-2026-120204

6.3MEDIUM

Key Information:

Vendor

Deepseek-ai

Status
Deepinfer
Vendor
CVE Published:
31 October 2026

What is CVE-2026-120204?

DeepInfer version 0.1.0 is susceptible to a path traversal vulnerability affecting the unauthenticated /profile endpoint. By exploiting this flaw, remote attackers can manipulate the output_dir parameter to create arbitrary directories on the server. This vulnerability allows attackers to execute cross-site GET requests from an operator's browser, potentially leading to the creation of excessive chrome trace files that may exhaust disk space or available inodes. Furthermore, attackers can utilize error messages to gather information about the filesystem, increasing the risk of further exploitation.

Affected Version(s)

DeepInfer 0 <= 0.1.0

References

https://github.com/deepseek-ai/DeepInfer/pull/242
issue-trackingpatch
https://github.com/deepseek-ai/DeepInfer/blob/553741557a5...
technical-description
https://github.com/deepseek-ai/DeepInfer
product

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lhy027
huangjicheng
.