Xinference Path Traversal Allows Unauthenticated File Deletion on Windows

Xinference, an open-source inference framework developed by xorbitsai, contains a path traversal vulnerability that allows unauthenticated attackers to manipulate files on Windows systems. The flaw, tracked as CVE-2026-112051, enables remote adversaries to write or delete arbitrary JSON files by injecting backslash sequences into the model_name parameter during model registration. This issue affects all versions of the software up to and including version 4.0.1.

Root cause

The underlying weakness is classified as CWE-22, indicating a failure to properly neutralize special elements in file paths. When the Xinference process handles incoming model registration requests, it does not adequately sanitize the model_name input. This oversight allows an attacker to append directory traversal characters, specifically backslashes, to the request payload. Consequently, the application interprets the input as a path instruction rather than a simple string, permitting access outside the intended directory structure.

Attack path

An attacker initiates exploitation by sending a POST request to the /v1/model_registrations/{model_type} endpoint. The request includes a malicious model_name value containing sequences like ..\..\evil. This input tricks the Xinference service into creating or overwriting files in parent directories relative to the application root. As the process runs with specific permissions, it can modify configuration or data files writable by the service account. This capability allows for persistent changes to the application state or potential disruption of service integrity.

Affected versions

• xorbitsai Xinference version 4.0.1
• xorbitsai Xinference version 4.0.0
• xorbitsai Xinference versions prior to 4.0.0

All deployments of Xinference on Windows operating systems are considered vulnerable until a patched version is released. Linux and macOS deployments are not explicitly cited in the National Vulnerability Database record for this specific vector, though verification of platform-specific behavior is recommended.

Mitigation

• Isolate Xinference instances from untrusted networks to prevent unauthenticated access to the API endpoints.
• Implement strict input validation on the model_name parameter to reject any requests containing backslash or forward slash characters.
• Run the Xinference service with the least privilege possible, restricting write access to only necessary configuration directories.
• Monitor file system integrity for unexpected changes to JSON configuration files within the application data directories.

Signals worth monitoring

Security teams should configure alerts for unusual HTTP POST requests targeting the model registration endpoints, specifically looking for payloads containing directory traversal sequences. File integrity monitoring solutions can detect unexpected modifications or deletions of JSON configuration files associated with the inference service. Additionally, monitoring for new process executions or service restarts following such file changes may indicate successful exploitation. Reviewing access logs for unauthenticated requests to administrative APIs is essential for identifying early reconnaissance or automated scanning activity targeting this vulnerability.

What to do and how to stay safe: Xinference

• Audit your current Xinference version and confirm if it is 4.0.1 or earlier on Windows hosts.
• Restrict network access to the Xinference API so that only trusted internal services can send registration requests.
• Enable detailed request logging to capture the full payload of incoming model registration attempts for forensic analysis.
• Prepare a containment plan that includes isolating affected hosts and restoring configuration files from known-good backups if anomalies are detected.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability allow remote code execution directly?

The NVD record rates the CVSS score at 8.3 HIGH, which accounts for the potential to overwrite system files and run code, similar to issues reported in XWorm C2 panels, though the primary mechanism is file manipulation.

Which specific files are targeted by this attack?

Attackers can target arbitrary .json files that are writable by the Xinference process, including configuration and data files used for model registration and persistence.

Is there a patch available for CVE-2026-112051?

No fix has been confirmed yet by the vendor. Users must rely on network segmentation and input validation mitigations until an updated version is released.