Vulnerability · Published Jun 27, 2024 · Assigned by @huntr_ai
CVE-2024-5980Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning
Critical 9.1
In plain English
A critical-severity path traversal in lightning-ai/pytorch-lightning from lightning-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | lightning | 2.3.3 | GHSA-mr7h-w2qc-ffc2 |
| PyPI | lightning | 2.3.3 | PYSEC-2026-386 |
| PyPI | pytorch-lightning | 2.3.3 | PYSEC-2026-3975 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| lightning-ai | lightning-ai/pytorch-lightning | unspecified – before 2.3.3 |
Weakness: CWE-22 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H