Xinference: Path traversal via model_name in custom model registration
Summary
Xinference through 4.0.1 on Windows contains a path traversal flaw in the custom model registration feature. An unauthenticated attacker can use backslash sequences in model_name to create, overwrite or delete .json files outside the intended model directory. Overwriting configuration or data files writable by the Xinference process may affect the service and its data.
Affected
- Xinference through 4.0.1 (CVE record: affected 0 to <= 4.0.1), Windows systems
- Version line and build to be confirmed in your installation, as other sources list 2.x releases
Fixed in
Unknown. No vendor-confirmed fixed version was found. The v4.1.0 release notes reportedly reject backslash, '.' and '..' in custom model names, but this has not been verified against the CVE's commit.
Workaround
- Do not expose the Xinference API to the internet or untrusted networks; restrict its port with a host firewall
- Run the service under an account that can only write to the model directories it needs
- Review the custom model directory for unexpected .json files
- Review logs for calls to the POST /v1/model_registrations/{model_type} endpoint
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Identify Windows hosts running Xinference and check whether the API is reachable from untrusted networks
- Apply the vendor's fix once confirmed; until then, apply the workarounds above
- Check the model directory and logs for unexpected registrations or files
- Monitor for changes to configuration and data files used by the service
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record source: cache_manager.py at v4.0.1 github.com
- CVE record source: utils.py at v4.0.1 github.com
- Fix commit beddc97ac211f8414597fe8479493be0603f7c84 github.com
- Xinference issue 5702 github.com
- VulnCheck advisory www.vulncheck.com
- Xinference v4.1.0 release github.com
- VulDB entry vuldb.com
- OffSeq radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:35.
Original description (NVD)
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1/model_registrations/{model_type} with names like ..\..\evil to overwrite configuration or data files writable by the Xinference process.
NVD references (5)
- https://github.com/xorbitsai/inference/blob/v4.0.1/xinference/model/cache_manager.py#L117-L134
- https://github.com/xorbitsai/inference/blob/v4.0.1/xinference/model/utils.py#L1175-L1182
- https://github.com/xorbitsai/inference/commit/beddc97ac211f8414597fe8479493be0603f7c84
- https://github.com/xorbitsai/inference/issues/5702
- https://www.vulncheck.com/advisories/xinference-through-4.0.1-path-traversal-via-model-name-in-custom-model-r…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.