{"id":"CVE-2026-120204","title":"DeepInfer through 0.1.0 Path Traversal via /profile output_dir Parameter","summary":"DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the output_dir parameter. Attackers, including cross-site GET reque…","severity":"medium","cvss":5.6,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","cvssSource":"cna","cwe":["CWE-22"],"vendor":"deepseek-ai","product":"DeepInfer","affected":["DeepInfer <= 0.1.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T17:03:52.892089Z"},"published":"2026-10-31","updated":"2026-11-02","sourceUpdated":"2026-11-02T17:45:36.440Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120204","references":[{"url":"https://github.com/deepseek-ai/DeepInfer/pull/242","label":"Pull Request #242"},{"url":"https://github.com/deepseek-ai/DeepInfer/blob/553741557a57df44a46fb3ab72b6aafeaf945337/deepinfer/engine/profile_server.py#L210"},{"url":"https://github.com/deepseek-ai/DeepInfer"},{"url":"https://www.vulncheck.com/advisories/deepinfer-through-0.1.0-path-traversal-via-profile-output-dir-parameter","label":"VulnCheck Advisory: DeepInfer through 0.1.0 Path Traversal via /profile output_dir Parameter"}],"tags":["cve.org"],"epss":0.0043,"epssPercentile":0.37478,"ingestedAt":"2026-11-05T19:30:42.749Z","slug":"CVE-2026-120204","body":"## Overview\n\nDeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the output_dir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files to exhaust disk or inodes and use error messages as a filesystem oracle.\n\n## Affected\n\n- `DeepInfer <= 0.1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":30.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}