CVE-2026-115812Critical· 9.8▾ MidnightRelative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life an…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive.
Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
multi-model-server <= 1.1.11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115813Medium· 5.8Server-side request forgery in the model download path in Amazon Web Services Multi Model Server
CVE-2026-89065High· 7.1Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the…
CVE-2026-115845Medium· 6.4Incomplete validation in the run_script Python sandbox in AWS MCP Server
CVE-2026-115419High· 8.1Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
CVE-2026-115414High· 7.8OS command injection in the Terraform hook in AWS SAM CLI
CVE-2026-115416High· 7.7Incorrect authorization checks in Amazon Athena engine version 3 query processing