CVE-2026-115812

Summary

The Amazon Web Services Multi Model Server (MMS) 1.1.11 and earlier contains a relative path traversal vulnerability (CWE-23) during model archive extraction, allowing remote attackers to write files outside the intended directory and potentially execute arbitrary code.

Exploitability

Exploitation is straightforward for remote attackers with network access, requiring only submission of a specially crafted compressed archive containing path traversal sequences (e.g., ../../etc/passwd).

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption across all models served by the vulnerable instance.

Detection

Defenders should monitor for unexpected file creation or modification outside the expected model deployment directories (e.g., in /etc, /tmp, or user home directories) during archive extraction events; however, no reliable host or network indicator is derivable from the published description.

Prioritized remediation

Discontinue use of Multi Model Server immediately and migrate to a supported model serving solution, as no fixed version is available for this end-of-life product.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.