high7.1
CVE-2024-12216
GluonCV Arbitrary File Write via TarSlip
Impact
A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | gluoncv | <= 0.10.0 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://huntr.com/bounties/46081fdc-2951-4deb-a2c9-2627007bdce0
- https://github.com/advisories/GHSA-m724-hqmc-ggpx
- https://nvd.nist.gov/vuln/detail/CVE-2024-12216
- https://github.com/dmlc/gluon-cv/blob/3862e2db33ab650eff7c7c5c5891e805207027b1/gluoncv/utils/filesystem.py#L223-L229