Amazon Web Services Multi Model Server: Relative path traversal (CVE-2026-115812)
Amazon Web Services Multi Model Server 1.1.11 and earlier is vulnerable to a relative path traversal attack during model archive extraction, which may allow remote actors to execute arbitrary code via a crafted model archive.
CVE search metadata
CVE search record: CVE-2026-115812. Severity: critical. CVSS: 9.8. KEV: no. Product: Multi Model Server (<= 1.1.11). Brief: Amazon Web Services Multi Model Server: Relative path traversal (CVE-2026-115812). Brief link: https://feed.craftedsignal.io/briefs/2026-10-aws-multi-model-server-path-traversal/
Triage facts
Revision 1- Applicability
- Multi Model Server (<= 1.1.11)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 23, 19:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Amazon Web Services Multi Model Server (MMS) versions 1.1.11 and earlier contain a relative path traversal vulnerability. An attacker can exploit this during model archive extraction to potentially execute arbitrary code. Multi Model Server is end of life and no fixed version is available.
Impact
The vulnerability has been assigned a CVSS v3.1 base score of 9.8.
Recommendation
- Discontinue use of Multi Model Server.
- Migrate to a supported model serving solution.