{"id":"CVE-2026-115812","published":"2026-10-23T18:17:21.460","lastModified":"2026-10-23T19:23:01.467","description":"Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.\n\n\n\nMulti Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-23"],"vendors":[],"products":[],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-148-aws/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Amazon Web Services Multi Model Server (MMS) 1.1.11 and earlier contains a relative path traversal vulnerability (CWE-23) during model archive extraction, allowing remote attackers to write files outside the intended directory and potentially execute arbitrary code.","exploitability":"Exploitation is straightforward for remote attackers with network access, requiring only submission of a specially crafted compressed archive containing path traversal sequences (e.g., ../../etc/passwd).","blast_radius":"Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption across all models served by the vulnerable instance.","remediation":"Discontinue use of Multi Model Server immediately and migrate to a supported model serving solution, as no fixed version is available for this end-of-life product.","detection":"Defenders should monitor for unexpected file creation or modification outside the expected model deployment directories (e.g., in /etc, /tmp, or user home directories) during archive extraction events; however, no reliable host or network indicator is derivable from the published description.","tags":["rce","path-traversal","web","mlops"],"model":"garnet-coder","analyzedAt":"2026-10-24T09:02:43.809Z"}}