Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
Amazon Web Services Multi Model Server, an end-of-life model serving tool, is affected by a path traversal flaw during model archive extraction. A remote attacker could potentially use a specially crafted model archive to run arbitrary code, and no fix is available, so users should stop using the software and move to a supported alternative.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
Affected versions
- AWS multi-model-server
through 1.1.11