CVE-2024-5980
criticalPriorität · verfolgen · 39EPSS 0.013 · 71. PerzentilEUUSEPSS · bewertet 2026-10-27
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (4)
Betroffene Produkte und Versionsbereiche.
- lightningai pytorch lightning2.2.4 → 2.3.3nvdUScpe:2.3:a:lightningai:pytorch_lightning:*:*:*:*:*:*:*:*
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-mr7h-w2qc-ffc2pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint2024-06-27ghsa · osvUS
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
- PYSEC-2026-386pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint2026-06-29vendor · osvUS
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
- PYSEC-2026-3975pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint2026-09-10vendor · osvUS
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (6)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2024-5980/cnnvd
- https://huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3cnnvd
- https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9aenisa_euvd
- https://huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3enisa_euvd
- https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9anvd
- https://huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3ExploitThird Party Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan