{"id":"CVE-2026-112051","kind":"vulnerability","aliases":["CVE-2026-112051"],"related":[],"title":"Xinference on Windows: path traversal lets unauthenticated users overwrite JSON files","description":"Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1/model_registrations/{model_type} with names like ..\\..\\evil to overwrite configuration or data files writable by the Xinference process.","summary":"Xinference through 4.0.1 fails to block backslash sequences in model_name on Windows. An unauthenticated attacker can register a custom model named like ..\\..\\evil to write and delete arbitrary .json files the Xinference process can reach.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-serving","self-hosted","windows","xinference"],"not_affected_if":["api-not-exposed","linux-only"],"how_to_check":"- Run `xinference --version` and compare against the fixed release listed in the advisory (unknown in sources)\n- Check whether the host runs Xinference on Windows and whether the API port is reachable from untrusted networks\n- Look for unexpected .json files written under the Xinference data or model directories","fix":"- Upgrade Xinference past `4.0.1` once a fixed release is published (fixed version unknown in sources)\n- Until then, block access to the Xinference API port from untrusted networks","status":"open","published_at":"2026-10-18T13:16:37+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:02:28+00:00","updated_at":"2026-10-25T03:02:28+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:02:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Xinference past `4.0.1` once a fixed release is published (fixed version unknown in sources)\n- Until then, block access to the Xinference API port from untrusted networks","reach":"network","title":"Xinference on Windows: path traversal lets unauthenticated users overwrite JSON files","impact":"high","summary":"Xinference through 4.0.1 fails to block backslash sequences in model_name on Windows. An unauthenticated attacker can register a custom model named like ..\\..\\evil to write and delete arbitrary .json files the Xinference process can reach.","category":"ai-tooling","nicknames":[],"who_cares":["xinference","windows","self-hosted","llm-serving"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker overwrites or deletes JSON config and data files on the server","analyst_note":"Confirm the fixed Xinference version and whether the flaw reaches beyond JSON files; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112051.","how_to_check":"- Run `xinference --version` and compare against the fixed release listed in the advisory (unknown in sources)\n- Check whether the host runs Xinference on Windows and whether the API port is reachable from untrusted networks\n- Look for unexpected .json files written under the Xinference data or model directories","needs_analyst":true,"not_affected_if":["linux-only","api-not-exposed"],"who_is_affected":"Teams running Xinference on Windows where the REST API is reachable, since POST /v1/model_registrations/{model_type} accepts model names with backslash sequences without authentication. Linux-only deployments are not described as affected by the source, and deployments that keep the API off untrusted networks are lower risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":3348,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112051':14A,17A '-2026':13A,16A '/v1/model_registrations':101C '4.0.1':31B,67C 'ai':19B 'ai-tool':18B 'allow':76C 'arbitrari':57B,83C 'attack':44B,78C,92C 'backslash':35B,87C 'block':34B 'configur':110C 'contain':68C 'custom':48B,97C 'cve':12A,15A 'data':112C 'delet':56B,82C 'evil':52B,107C 'fail':32B 'file':11A,59B,85C,113C 'host':26B 'json':10A,58B,84C 'let':6A 'like':51B,106C 'llm':22B 'llm-serv':21B 'model':38B,49B,90C,98C,102C 'name':39B,50B,91C,105C 'overwrit':9A,109C 'path':4A,70C 'persist':96C 'post':100C 'process':62B,118C 'reach':64B 'regist':46B,94C 'self':25B 'self-host':24B 'sequenc':36B,88C 'serv':23B 'tool':20B 'travers':5A,71C 'type':103C 'unauthent':7A,43B,77C 'user':8A 'via':86C 'vulner':72C 'window':3A,27B,41B,74C 'writabl':114C 'write':54B,80C 'xinfer':1A,28B,29B,61B,65C,117C","nicknames":[],"mitigations":[],"who_affected":"Teams running Xinference on Windows where the REST API is reachable, since POST /v1/model_registrations/{model_type} accepts model names with backslash sequences without authentication. Linux-only deployments are not described as affected by the source, and deployments that keep the API off untrusted networks are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112051","severity":null,"published_at":"2026-10-18T13:16:37+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}