PT-2024-37290 · Pypi · Pytorch-Lightning

Published 2024-06-27 · Updated 2025-07-30 · CVE-2024-5980

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: pytorch-lightning version 2.2.4

Description: A path traversal issue exists in the "/v1/runs" API endpoint, allowing attackers to exploit this vulnerability when extracting tar.gz files. This can be used to deploy malicious tar.gz plugins that embed arbitrary files, potentially leading to arbitrary files being written to any directory in the victim's local file system and remote code execution.

Recommendations: For pytorch-lightning version 2.2.4, as a temporary workaround, consider disabling the plugin server to minimize the risk of exploitation. Avoid using the /v1/runs API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Unrestricted File Upload

Weakness Enumeration

CWE-22

CWE-434

Related Identifiers

CVE-2024-5980

GHSA-MR7H-W2QC-FFC2

Affected Products

Pytorch-Lightning

References · 9

• 🔥 https://huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-5980 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5980 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mr7h-w2qc-ffc2 · Vendor Advisory
• https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a · Note
• https://github.com/lightning-ai/pytorch-lightning · Note
• https://github.com/Lightning-AI/pytorch-lightning/pull/20039 · Note
• https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.3.3 · Note
• https://t.me/cveNotify/130295 · Telegram Post