Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-9363Unauthorized File Deletion in polyaxon/polyaxon

High 7.5

In plain English

A high-severity security flaw in polyaxon/polyaxon from polyaxon. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)1.1%top 35.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

An unauthorized file deletion vulnerability exists in the latest version of the Polyaxon platform, which can lead to denial of service by terminating critical containers. An attacker can delete important files within the containers, such as `polyaxon.sock`, causing the API container to exit unexpectedly. This disrupts related services and prevents the system from functioning normally, without requiring authentication or UUID parameters.

Affected products (as reported)

Vendor	Product	Versions
polyaxon	polyaxon/polyaxon	unspecified – through latest

Weakness: CWE-23 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://huntr.com/bounties/ec7b7e1d-795d-4414-93d5-9df35d2fd391