PT-2025-12125 · Unknown · Dmlc/Gluon-Cv

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-12216

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions dmlc/gluon-cv version 0.10.0

Description A vulnerability in the ImageClassificationDataset.from csv() API allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.

Recommendations As a temporary workaround, consider disabling the ImageClassificationDataset.from csv() function until a patch is available. Restrict access to the dmlc/gluon-cv repository version 0.10.0 to minimize the risk of exploitation. Avoid using the ImageClassificationDataset.from csv() API in the affected version until the issue is resolved.

Fix

Path traversal

Link Following

RCE

Weakness Enumeration

CWE-22

CWE-59

CWE-20

Related Identifiers

CVE-2024-12216

GHSA-M724-HQMC-GGPX

Affected Products

Dmlc/Gluon-Cv

References · 6

• https://osv.dev/vulnerability/GHSA-m724-hqmc-ggpx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12216 · Security Note
• https://github.com/dmlc/gluon-cv · Note
• https://github.com/dmlc/gluon-cv/blob/3862e2db33ab650eff7c7c5c5891e805207027b1/gluoncv/utils/filesystem.py#L223-L229 · Note
• https://huntr.com/bounties/46081fdc-2951-4deb-a2c9-2627007bdce0 · Note
• https://twitter.com/CVEnew/status/1902968898187825605 · Twitter Post