Zero Radar
← feed
CriticalVulnerabilityCVE-2026-115812updated 25 Oct 2026, 17:20 UTC

AWS Multi Model Server can run attacker code via a crafted model file

A specially built model archive can trick the server into writing files outside its folder, which can let an outsider run their own code on the machine. The product is retired and no fix is coming.

No fix yetOfficial, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Not yetUse the workaround below until a patch ships
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts archiveModel file contains traversal paths
  2. 2Archive uploadedSent to the model server
  3. 3Unsafe extractionFiles written outside intended folder
  4. 4Code executedAttacker payload runs on server
  5. ResultAttacker runs code on the server

What happened

A relative path traversal flaw during model archive extraction in AWS Multi Model Server 1.1.11 and earlier allows remote actors to execute arbitrary code by supplying a crafted model archive.

Why it is dangerous: A successful attacker could run arbitrary code on the server hosting the model, giving them control over the system and any data or services it can reach.

Are you affected?

You are affected if you run AWS Multi Model Server version 1.1.11 or earlier to serve machine learning models.

AWS Multi Model Server 1.1.11 and earlier

What to do

  1. Stop using Multi Model Server and migrate model serving to a supported solution
  2. Until then, do not load model archives from untrusted sources
  3. Restrict network access to the server so only trusted clients can reach it

Timeline

  1. 23 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 23 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115812 · GHSA-3v4f-xjg3-3j32
CVSS
9.3 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
23 Oct 2026, 18:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

AWS Multi Model Server can run attacker code via a crafted model file · Zero Radar