CVE-2026-115812: Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.
Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Discontinue use of Amazon Web Services Multi Model Server and migrate to a supported model serving solution.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted model archive to a vulnerable Multi Model Server instance. The vulnerability is remotely exploitable and requires no privileges or user interaction.
Are default deployments affected?
The provided data does not identify any configuration prerequisite. Because the issue affects Multi Model Server 1.1.11 and earlier, deployments using those versions should be treated as affected when they process model archives.
What should teams do if they cannot patch immediately?
There is no fixed version because Multi Model Server is end of life. Users should discontinue its use and migrate to a supported model serving solution.
How can teams determine whether they are affected?
Identify whether Amazon Web Services Multi Model Server is deployed and check its version. Versions 1.1.11 and earlier are affected.