CVE-2024-12065: Local File Inclusion in LLaVA

The impact of this vulnerability is significant due to the potential for attackers to gain access to sensitive data stored on the server. An attacker could leverage this LFI to read configuration files, source code, or even private keys, depending on the server's file system structure and permissions. Successful exploitation could lead to data breaches, unauthorized access to systems, and potential compromise of the entire environment. While the vulnerability requires multiple requests, the ease of crafting these requests makes it a relatively accessible attack vector. The gradio web UI is often used for demonstration and experimentation, increasing the likelihood of exposure.

1. Reserved2024-12-02
2. Published2025-03-20
3. Modified2025-10-15
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-12065 is to upgrade to a patched version of LLaVA as soon as it becomes available. Until a patch is released, several temporary mitigations can be implemented. First, restrict file access permissions on the server to minimize the potential impact of a successful exploit. Second, implement stricter input validation on the gradio web UI component to prevent attackers from manipulating file paths. Consider using a Web Application Firewall (WAF) to filter malicious requests. Regularly review server logs for suspicious activity related to file access attempts.