CVE-2024-12065CWE-22

Local File Inclusion in haotian-liu/llava

High · published March 20, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
60.7
In the wild
Unconfirmed
What it is

A local file inclusion vulnerability exists in haotian-liu/llava at commit c121f04. This vulnerability allows an attacker to access any file on the system by sending multiple crafted requests to the server. The issue is due to improper input validation in the gradio web UI component.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00945 · 60.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-03-20T10:09Z
EPSS history
Timeline
  • 20 MAR 10:09Z
    Local File Inclusion in haotian-liu/llava
    cvelistv5