GitHub Advisoryadvisory · PyPI

GHSA-m724-hqmc-ggpx GluonCV Arbitrary File Write via TarSlip

HIGH Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-12216
Ecosystem
PyPI
Packages
gluoncv
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weaknesses
CWE-20, CWE-22, CWE-59
Reviewed
2025-03-21

Affected packages

• PyPI gluoncv: <= 0.10.0 (no fix yet)

Description

A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.

Related

Alias · CVE (1)

  • CVE-2024-12216 A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary… vulnerability

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References