Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2024-5980: PyTorch-Lightning 2.2.4 can write any file via API
CVE-2024-5980 · published 2 years ago
Summary
The PyTorch-Lightning package version 2.2.4, when used with the plugin_server feature, lets an attacker upload a specially crafted tar.gz file through the /v1/runs endpoint. The malicious archive can place files anywhere on the server’s disk, which could lead to the attacker running their own code. Update to a newer release or turn off the plugin_server feature to remove the risk.
What to do
- Update lightning ai et al. lightning to version 2.3.3.
- Update pytorch-lightning to version 2.3.3.
- Update lightningai pytorch_lightning to version 2.3.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | lightning ai et al. | lightning |
<= 2.3.1 Fix: upgrade to 2.3.3
|
| – | lightningai | pytorch_lightning |
>= 2.2.4, < 2.3.3 cpe:2.3:a:lightningai:pytorch_lightning:*:*:*:*:*:python:*:* |
| PyPI | – | pytorch-lightning |
< 2.3.3 Fix: upgrade to 2.3.3
|
Original advisory text
pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5980.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-5980 Vendor Advisory
- https://github.com/Lightning-AI/pytorch-lightning/pull/20039 URL
- https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418...
- https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.3.3 URL
- https://github.com/lightning-ai/pytorch-lightning Product
- https://pypi.org/project/lightning Product
- https://github.com/advisories/GHSA-mr7h-w2qc-ffc2 Vendor Advisory
- https://huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3 Exploit Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
9.8
Critical
Type
CWE-22Path Traversal
CWE-434Unrestricted File Upload
Timeline
Published27 Jun 2024
Updated7 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta