Cpe:2.3:a:amazon:multi_model_server:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aamazonmulti_model_server/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 19:51:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAmazon Web Services Multi Model Server: Relative path traversal (CVE-2026-115812)https://feed.craftedsignal.io/briefs/2026-10-aws-multi-model-server-path-traversal/Fri, 23 Oct 2026 19:51:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-aws-multi-model-server-path-traversal/Amazon Web Services Multi Model Server 1.1.11 and earlier is vulnerable to a relative path traversal attack during model archive extraction, which may allow remote actors to execute arbitrary code via a crafted model archive.Amazon Web Services Multi Model Server (MMS) versions 1.1.11 and earlier contain a relative path traversal vulnerability. An attacker can exploit this during model archive extraction to potentially execute arbitrary code. Multi Model Server is end of life and no fixed version is available.

Impact

The vulnerability has been assigned a CVSS v3.1 base score of 9.8.

Recommendation

  • Discontinue use of Multi Model Server.
  • Migrate to a supported model serving solution.
]]>criticaladvisory