CVE-2024-5980
criticalpriority · track · 39EPSS 0.013 · 71 %ileEUUSEPSS · scored 2026-10-27
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
- lightningai pytorch lightning2.2.4 → 2.3.3nvdUScpe:2.3:a:lightningai:pytorch_lightning:*:*:*:*:*:*:*:*
advisories (3)
Vendor and ecosystem advisories describing this.
- GHSA-mr7h-w2qc-ffc2pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint2024-06-27ghsa · osvUS
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
- PYSEC-2026-386pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint2026-06-29vendor · osvUS
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
- PYSEC-2026-3975pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint2026-09-10vendor · osvUS
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-5980/cnnvd
- https://huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3cnnvd
- https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9aenisa_euvd
- https://huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3enisa_euvd
- https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9anvd
- https://huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3ExploitThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan