Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2024-8019: PyTorch Lightning lets attackers overwrite any file on Windows
CVE-2024-8019 · published 1 year ago
Summary
The PyTorch Lightning library (version 2.3.2) can be tricked into writing or replacing files when its upload endpoint is used on a Windows system. An attacker could place malicious files or replace important system files, potentially leading to code execution. Update to a patched version or disable the vulnerable upload feature until the fix is applied.
What to do
- Update lightning ai et al. pytorch-lightning to version 2.4.0.
- Update lightning to version 2.4.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | lightning ai et al. | pytorch-lightning |
< 2.4.0 Fix: upgrade to 2.4.0
|
| – | lightningai | pytorch_lightning |
2.3.2 cpe:2.3:a:lightningai:pytorch_lightning:2.3.2:*:*:*:*:python:*:* |
| PyPI | – | lightning |
< 2.4.0 Fix: upgrade to 2.4.0
|
Original advisory text
PyTorch Lightning path traversal vulnerability
In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-8019 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8019.j... Vendor Advisory
- https://github.com/pytorch/pytorch Product
- https://huntr.com/bounties/2754298b-5af5-48ef-8b38-999093ddf2bd Exploit Third Party Advisory
- https://pypi.org/project/pytorch-lightning Product
- https://github.com/advisories/GHSA-4cv3-v7pv-rfhf Vendor Advisory
- https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418... Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-434Unrestricted File Upload
Timeline
Published20 Mar 2025
Updated12 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta