CVE-2026-112051: Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/{modeltype} with names like ..\..\evil to overwrite configuration or data files writable by the Xinference process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Xinference through version 4.0.1 on Windows. It is reachable through the custom model registration endpoint when an unauthenticated remote attacker can send requests to it.
What does an attacker need to exploit the vulnerability?
An attacker needs network access to POST /v1/model_registrations/{model_type}; no authentication or user interaction is required. Exploitation requires crafting model_name with Windows backslash traversal sequences such as ..\..\evil.
What could an attacker change?
The attacker can write or delete arbitrary .json files that are writable by the Xinference process. This may allow overwriting configuration or data files within the process's write permissions.
What can be done while a fix is not available?
Restrict unauthenticated network access to the custom model registration endpoint, particularly from untrusted networks. Run the Xinference process with minimal filesystem permissions so it cannot write sensitive configuration or data locations.