Platform
python
Component
paddlepaddle/paddle
Fixed in
2.6
CVE-2024-0818 is a critical Path Traversal vulnerability affecting PaddlePaddle versions prior to 2.6. This flaw allows attackers to overwrite arbitrary files on the system, potentially leading to complete system compromise. The vulnerability was published on March 7, 2024, and a fix is available in version 2.6.
The core of this vulnerability lies in PaddlePaddle's insufficient validation of user-supplied file paths. An attacker can craft malicious input that bypasses these checks, allowing them to specify a path outside the intended directory. This enables the overwriting of critical system files, configuration files, or even executable code. Successful exploitation could result in remote code execution, data corruption, denial of service, or complete system takeover. The impact is particularly severe given PaddlePaddle's use in machine learning and AI applications, where compromised models or data could have far-reaching consequences.
CVE-2024-0818 is currently not listed on the CISA KEV catalog. Public proof-of-concept exploits are not widely available, but the severity of the vulnerability (CVSS 9.1) suggests a high probability of exploitation if a suitable exploit is developed. The vulnerability's impact on machine learning workflows could make it a target for advanced persistent threat (APT) actors.
Exploit Status
EPSS
0.34% (57% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-0818 is to immediately upgrade to PaddlePaddle version 2.6 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing strict input validation on file paths within your application code. While not a complete solution, restricting access to sensitive directories and implementing file integrity monitoring can help limit the potential damage. Consider using a Web Application Firewall (WAF) with path traversal protection rules, though this is less effective than patching the underlying vulnerability. After upgrade, confirm by attempting to trigger the vulnerable functionality and verifying that file access is properly restricted.
Update the paddlepaddle/paddle library to version 2.6 or higher. This will resolve the arbitrary file overwrite via path traversal vulnerability. You can update using the pip package manager: `pip install paddlepaddle --upgrade`.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-0818 is a critical Path Traversal vulnerability in PaddlePaddle versions before 2.6, allowing attackers to overwrite arbitrary files.
If you are using PaddlePaddle versions prior to 2.6, you are potentially affected by this vulnerability.
Upgrade to PaddlePaddle version 2.6 or later to resolve this vulnerability. Implement input validation as a temporary workaround.
While no active exploitation has been confirmed, the high severity score suggests a potential for exploitation if a suitable exploit is developed.
Refer to the PaddlePaddle security advisory for detailed information and updates: [https://github.com/PaddlePaddle/Paddle/security/advisories/GHSA-9999](https://github.com/PaddlePaddle/Paddle/security/advisories/GHSA-9999)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.