CVE-2024-5980: Arbitrary File Access in pytorch-lightning

The primary impact of CVE-2024-5980 is the potential for remote code execution (RCE). An attacker can leverage the path traversal vulnerability in the /v1/runs API to upload a malicious tar.gz plugin. This plugin, when processed by pytorch-lightning, can be crafted to write arbitrary files to any directory accessible by the LightningApp process. This could include overwriting critical system files, injecting malicious code, or gaining persistent access to the system. The blast radius extends to any system running a vulnerable pytorch-lightning instance with the plugin_server enabled, particularly those handling sensitive data or critical infrastructure.

1. Reserved2024-06-13
2. Published2024-06-27
3. Modified2025-10-21
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-5980 is to upgrade to pytorch-lightning version 2.3.3 or later, which contains the fix. If upgrading immediately is not feasible, consider disabling the plugin_server feature to prevent the vulnerable API endpoint from being exposed. As a temporary workaround, implement strict input validation on the /v1/runs API endpoint to prevent path traversal attempts. This could involve whitelisting allowed file extensions and validating the destination directory. Monitor system logs for suspicious file creation or modification activity.