CVE-2026-115812

Unsupported AWS Multi Model Server extracts archives outside their directory

AWS · Multi Model Server

First documented disclosure · Review checkpoint

Summary

A crafted model archive can write outside model storage and potentially execute code.

Severity and exploitation evidence

Critical · 9.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Vendor disclosure; malicious exploitation and confirmed victim compromise are not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Model archive extraction does not confine resolved entry paths to the extraction directory.

Conditions required

The actor can reach the unauthenticated management interface and supply a model archive or URL. Risk rises when management binds to a network-accessible address.

Potential impact

Potential code execution with the MMS process’s privileges, following archive writes outside the intended directory.

Affected versions and configurations

All released MMS versions through 1.1.11.

Fix and mitigation status

None available or planned: MMS is end of life.

Practical next steps

Migrate to a supported model server. Temporarily isolate management to loopback where separate ports permit; shared-port SageMaker-style configurations require trusted-only access while migrating.

Operating lesson

Unsupported inference infrastructure needs a replacement plan, not an assumed future patch.

Evidence and limits

AWS disclosed both distinct weaknesses October 23; later registry modifications do not reset that date. AWS says the repository was archived November 20, 2025. Its shared-port configuration cannot move management alone to loopback. CNA scores use CVSS 4.0; reviewed sources do not establish exploitation.

Sources