Unrestricted Upload of File with Dangerous Type Affecting pytorch-lightning package, versions [0,2.4.0)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-PYTORCHLIGHTNING-7411413
- published 28 Jun 2024
- disclosed 27 Jun 2024
- credit zpbrent
Introduced: 27 Jun 2024
CVE-2024-5980 Open this link in a new tabHow to fix?
Upgrade pytorch-lightning to version 2.4.0 or higher.
Overview
pytorch-lightning is a lightweight PyTorch wrapper for ML researchers. Scale your models. Write less boilerplate.
Affected versions of this package are vulnerable to Unrestricted Upload of File with Dangerous Type through the /v1/runs API endpoint when extracting tar.gz files. An attacker can deploy the malicious tar.gz plugins that exploit path traversal vulnerabilities, allowing to write files to arbitrary locations on the victim's file system.