AWS Multi Model Server: Path traversal leading to code execution
Summary
Amazon Web Services Multi Model Server (MMS) 1.1.11 and earlier contains a relative path traversal flaw during model archive extraction. A remote attacker can supply a crafted model archive that writes files outside the intended directory, potentially executing arbitrary code with the privileges of the MMS process. The management interface does not require authentication, and deployments that expose it to a network are at increased risk. MMS is end of life and no fixed version is available.
Affected
- Amazon Web Services Multi Model Server (multi-model-server) versions 1.1.11 and earlier (all released versions)
- Packages published on PyPI, GitHub and Docker Hub (per vendor bulletin)
Fixed in
- Unknown. No fixed version is available or planned on any distribution channel.
Workaround
- Bind the management interface to the loopback address where the deployment allows it.
- Do not pass externally supplied URLs to the model download path.
- Limit access to the serving port to trusted callers only.
- For SageMaker-style configurations, management cannot be moved to loopback without disabling model loading; prioritise migration.
- Forks: reject archive entries resolving outside the extraction directory and allow only an explicit list of download URLs.
Exploitation
- No confirmed exploitation in the wild known at the time of writing.
- No public proof-of-concept exploit indexed at the time of writing.
- Not listed in CISA KEV according to secondary sources (unverified).
- Absence of public exploits does not prove absence of exploitation.
Our recommendation
- Inventory all hosts, container images and virtualenvs for multi-model-server, including Docker and PyPI installs.
- If an instance exists, remove internet exposure and restrict network access to known callers.
- Keep the management interface off untrusted networks.
- Plan migration to a supported model-serving product.
- Review archive handling and logs of any exposed instance and treat it as a potential compromise until verified.
- Re-check the NVD entry and the AWS bulletin 2026-148-AWS for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-148-AWS aws.amazon.com
- CVE record (CVE List V5, JSON) raw.githubusercontent.com
- VulDB entry 426004 vuldb.com
- Strix CVE record www.strix.ai
- AWS Multi Model Server GitHub repository (archived) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:46.
Original description (NVD)
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.