Medium severity5.6NVD Advisory· Published Oct 31, 2026

CVE-2026-120204

Description

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the output_dir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files to exhaust disk or inodes and use error messages as a filesystem oracle.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Deepseek AI/DeepInferllm-create
Range: <=0.1.0

Patches

Vulnerability mechanics

References

github.com/deepseek-ai/DeepInfer/blob/553741557a57df44a46fb3ab72b6aafeaf945337/deepinfer/engine/profile_server.pynvd
github.com/deepseek-ai/DeepInfer/pull/242nvd
www.vulncheck.com/advisories/deepinfer-through-0.1.0-path-traversal-via-profile-output-dir-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.364
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000