PT-2025-12204 · Pypi · Pytorch-Lightning

Published 2025-03-20 · Updated 2025-08-01 · CVE-2024-8019

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions lightning-ai/pytorch-lightning version 2.3.2

Description A vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/upload file/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-8019

GHSA-4CV3-V7PV-RFHF

Affected Products

Pytorch-Lightning

References · 8

• 🔥 https://huntr.com/bounties/2754298b-5af5-48ef-8b38-999093ddf2bd · Exploit
• https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a · Patch
• https://osv.dev/vulnerability/GHSA-4cv3-v7pv-rfhf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8019 · Security Note
• https://github.com/pytorch/pytorch · Note
• https://twitter.com/CVEnew/status/1903336848031732226 · Twitter Post
• https://t.me/cveNotify/130494 · Telegram Post