What is CVE-2026-120204?

CVE-2026-120204 is a medium-severity vulnerability in Deepseek-Ai Deepinfer, classified under Path Traversal. CVSS score: 5.6/10. Published 2026-10-31.

How severe is CVE-2026-120204?

Medium severity. CVSS v3 base score is 5.6 out of 10.

Path Traversal in Deepseek-Ai Deepinfer

CVE-2026-120204

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the output_dir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files to exhaust disk or inodes and use error messages as a filesystem oracle.

Vulnerability class: Path Traversal (Directory Traversal)

Published 2026-10-31.

CVSS v3 metric

CVSS v3 base score 5.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Deepseek-Ai Deepinfer

Weakness classification (CWE)

CWE-22 — Path Traversal

References

github.com/deepseek-ai/DeepInfer/pull/242 (issue-tracking, patch)
github.com/deepseek-ai/DeepInfer/blob/553741557a57df44a46fb3ab72b6aafeaf945337/… (technical-description)
github.com/deepseek-ai/DeepInfer (product)
www.vulncheck.com/advisories/deepinfer-through-0.1.0-path-traversal-via-profile… (third-party-advisory)

Frequently asked questions

What is CVE-2026-120204?: CVE-2026-120204 is a medium-severity vulnerability in Deepseek-Ai Deepinfer, classified under Path Traversal. CVSS score: 5.6/10. Published 2026-10-31.
How severe is CVE-2026-120204?: Medium severity. CVSS v3 base score is 5.6 out of 10.