CVE-2024-12216CWE-59

Arbitrary File Write via TarSlip in dmlc/gluon-cv

High · published March 20, 2025

CVSS v3.0
7.1
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.

The record
Technical detail
CVSS v3.0
7.1 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00312 · 22.9th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2025-03-20T10:09Z
EPSS history
Timeline
  • 20 MAR 10:09Z
    Arbitrary File Write via TarSlip in dmlc/gluon-cv
    cvelistv5