---
id: "CVE-2026-120204"
kind: "vulnerability"
aliases: ["CVE-2026-120204"]
title: "DeepInfer: unauthenticated /profile endpoint lets remote users create arbitrary directories"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "deepinfer", "fixed": [], "affected": "<= 0.1.0", "ecosystem": "pip"}]
ecosystems: []
tags: ["ai-inference", "ai-tooling", "deepinfer", "opt-in-endpoint", "python"]
not_affected_if: ["default-config", "endpoint-not-exposed"]
published_at: "2026-10-31T18:17:08+00:00"
first_seen_at: "2026-10-31T18:37:12+00:00"
updated_at: "2026-10-31T18:42:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120204", "first_seen_at": "2026-10-31T18:37:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T18:42:11+00:00"}]
---

# DeepInfer: unauthenticated /profile endpoint lets remote users create arbitrary directories

DeepInfer through 0.1.0 has an unauthenticated /profile endpoint whose output_dir parameter is not restricted, so remote attackers can create directories anywhere the process can write. Attackers can also fill the disk or inodes with trace files and use error messages to map the filesystem.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:deepinfer affected <= 0.1.0 fixed ?

## How to check

- Check whether the profiling server is enabled: look for DEEPINFER_PROFILE_HTTP_ENABLE=1 in the environment of your DeepInfer engine processes. Per the code it is off by default.
- If enabled, it listens on DEEPINFER_PROFILE_HTTP_PORT_BASE + GPU id (default base 6070 per a third-party write-up); check with 'ss -ltnp' whether those ports are reachable beyond localhost.
- Installed version: 'pip show deepinfer' (not confirmed whether the package is on PyPI; the project is built from source via build.sh).

## Timeline

- 2026-10-31T18:37:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120204
- 2026-10-31T18:42:11+00:00 analyst — No vendor advisory or release found; repo has no releases, fix unconfirmed. Open unmerged community PR #242 hardens the profile server (not linked to CVE by any source). Profile server is off by default (DEEPINFER_PROFILE_HTTP_ENABLE=1), per third-party source mirror/blog, not vendor docs. Nothing marked verified.

## Documents

- [describes] deepseek-ai/DeepInfer repository (README, no releases, no advisories) https://github.com/deepseek-ai/DeepInfer
- [describes] DeepInfer profile_server.py annotated source (third-party mirror) https://inf.latent.space/file/deepinfer/engine/profile_server.py
- [mentions] DeepInfer open PRs incl. #242 harden profiling HTTP server (unmerged) https://github.com/deepseek-ai/DeepInfer/pulls

## From the sources

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the output_dir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files to exhaust disk or inodes and use error messages as a filesystem oracle.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_