Xinference, specifically version 3.3.0 and earlier, has an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a model_path parameter without any authentication or path confinement. It reads config.json, tokenizer_config.json, and chat_template.jinja from the supplied path, parses them, and returns the parsed content. This allows an attacker to read the contents of any file named with those extensions located anywhere on the server filesystem, exposing sensitive configuration data. The weakness is a path traversal flaw (CWE‑73).

The affected product is Xinference by XORBITS AI, with vulnerability present in commit 4a94832 and released in version 3.3.0. The issue applies to all releases under the 3.x series until a fix is applied.

The CVSS score of 8.7 indicates high severity. In the absence of an EPSS score or KEV listing, the risk remains high but exploitation probability cannot be quantified. The flaw can be exploited remotely, without authentication, by sending a crafted request to the /v1/models/llm/auto-register endpoint with an arbitrary model_path. An attacker can read arbitrary files, leading to confidentiality compromise. The lack of authentication and path validation makes the vulnerability trivial to exploit if the endpoint is exposed to network traffic.