Xinference Path Traversal Flaw Lets Attackers Delete Files on Windows
Unauthenticated attackers can overwrite configuration files in Xinference versions up to 4.0.1 using path traversal techniques on Windows systems.
Key points
- CVE-2026-112051 allows unauthenticated file deletion and creation.
- The flaw affects Xinference versions through 4.0.1 on Windows.
- Attackers exploit the model registration endpoint to traverse directories.
Xinference versions up to 4.0.1 contain a high-severity path traversal vulnerability on Windows systems. Unauthenticated attackers can use this flaw to write or delete arbitrary JSON files by manipulating the model name parameter.
What happened
The vulnerability, tracked as CVE-2026-112051, carries a CVSS score of 8.3, which classifies it as high severity according to the National Vulnerability Database. The flaw exists in the Xinference software developed by xorbitsai. It affects all versions of the product up to and including 4.0.1. The issue is specific to Windows environments.
Attackers exploit the vulnerability by sending a POST request to the /v1/model_registrations/{model_type} endpoint. They register a custom model with a name containing backslash sequences, such as "..\..\evil". This input allows the attacker to traverse the directory structure. The Xinference process then writes or deletes JSON files in locations it has permission to access.
This capability enables attackers to overwrite configuration files or other data files writable by the application. The attack does not require authentication. The weakness is categorized under CWE-22, which refers to path traversal issues. The source material does not indicate that a patch has been released for this specific CVE.
Why it matters
The ability to write arbitrary files can lead to configuration changes that compromise system integrity. Deleting critical JSON files may disrupt service availability or alter application behavior. Since the attack is unauthenticated, any network user can attempt exploitation. The high CVSS score reflects the ease of exploitation and potential impact.
Organizations running Xinference on Windows are directly exposed. The flaw allows persistent changes through custom model registration. Attackers can target files that the Xinference process can modify. This could lead to unauthorized control over application settings. The lack of authentication requirements lowers the barrier for attackers.
What to watch
- Monitor network traffic for unusual POST requests to model registration endpoints.
- Check file system logs for unexpected creation or deletion of JSON files.
- Verify that model names do not contain backslash sequences or directory traversal characters.
- Review access controls for directories writable by the Xinference process.
Who needs to act first
Teams should prioritize updating systems that expose the Xinference service to untrusted networks. Check whether any instances are running on Windows with versions up to 4.0.1. Roll out changes after testing in isolated environments to ensure stability. Back up configuration files before making any modifications. If a patch is not yet available, restrict network access to the service. Limit exposure by placing the service behind a firewall that blocks unauthenticated traffic. Monitor logs for signs of directory traversal attempts.
Background: CVSS score
The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.
Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes
What to do and how to stay safe: Xinference
- Restrict network access to the Xinference service to trusted IPs only.
- Implement input validation to reject model names containing backslashes.
- Monitor file system changes for unexpected JSON file modifications.
- Wait for an official update from xorbitsai before applying unverified fixes.
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Xinference are affected by CVE-2026-112051?
All versions of Xinference up to and including 4.0.1 are affected.
Is authentication required to exploit this vulnerability?
No, the vulnerability allows unauthenticated attackers to exploit the flaw.
What operating systems are impacted by this path traversal issue?
The vulnerability specifically affects Windows systems running the affected software.
