Description

Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model_path parameter without authentication or path confinement. The endpoint reads and parses config.json, tokenizer_config.json, and chat_template.jinja files at the supplied path and reflects the parsed content back to the caller, allowing an unauthenticated attacker to probe the server filesystem and extract content of files with those names in any directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T15:17:44.693Z",
  "pubdate": "2026-09-04T15:17:44.693Z",
  "executiveSummary": "Xinference, specifically commit 4a94832 and v3.x series, contains a critical security vulnerability involving an unauthenticated arbitrary file read mechanism.\nThe vulnerability resides in the POST /v1/models/llm/auto-register endpoint, which fails to implement path validation or confinement, allowing an attacker to supply an arbitrary 'model_path'.\nThis flaw permits unauthenticated remote attackers to perform filesystem discovery and exfiltration of sensitive configuration files, specifically 'config.json', 'tokenizer_config.json', and 'chat_template.jinja'.\nThe risk is significant as it provides an attacker with the ability to probe the underlying server infrastructure and extract sensitive information from the filesystem without any prior authentication or authorization.\nThe vulnerability manifests due to the application's trust in user-provided input when performing file I/O operations, bypassing essential security boundary constraints.",
  "technicalDetails": "The vulnerability is located in the '/v1/models/llm/auto-register' endpoint, which facilitates the dynamic registration of LLM models. The root cause is the lack of input sanitization and directory traversal protection on the 'model_path' parameter.\nWhen a POST request is received, the application logic processes the 'model_path' argument to identify and load necessary configuration files for the model. The system proceeds to access and parse 'config.json', 'tokenizer_config.json', and 'chat_template.jinja' from the directory specified by the attacker.\nThe application subsequently reads the contents of these files and reflects the parsed data back to the caller in the API response. Because the application does not validate if the path resides within an intended repository or restricted directory, an attacker can traverse the file system by providing relative or absolute paths (e.g., '/etc/', '/home/', etc.).\nAttack Flow: 1. Attacker identifies the target endpoint '/v1/models/llm/auto-register'. 2. Attacker crafts a POST request containing a malicious 'model_path' parameter pointing to a sensitive system directory. 3. The server application attempts to locate 'config.json' or related files within the attacker-specified path. 4. If a file with the target name exists in that directory, the application parses the file contents. 5. The server transmits the parsed content back to the client as part of the API response, confirming successful file exfiltration.\nThis vulnerability is classified as an unauthenticated access flaw because the endpoint does not require session validation or authorization checks. The exposure is network-wide, assuming the API is reachable. The impact includes, but is not limited to, the disclosure of system credentials, server configurations, environment variables, or other sensitive data that may be structured within files named according to the targeted schema.\nBecause the application specifically targets JSON and JINJA formats for parsing, the attacker is limited to reading files that follow or can be processed under these formats, though often sensitive system configurations meet these criteria. The inability of the software to constrain the file read operation to a 'jail' or root model directory renders the entire filesystem exposed to any reachable service instance."
}