PT-2026-85561

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied model path parameter without authentication or path confinement. The endpoint reads and parses config.json...