Search
Find a vulnerability
Search criteria
10 vulnerabilities found for TorchServe by PyTorch
CVE-2026-123974 (GCVE-0-2026-123974)
Vulnerability from nvd – Published: 2026-11-06 19:52 – Updated: 2026-11-06 20:18 Unsupported When Assigned
VLAI
EPSS
VEX
Title
pytorch/serve: Local privilege escalation through insecure temporary path
Summary
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 20:18 UTC
CWE
- CWE-379 - Creation of temporary file in directory with insecure permissions
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PyTorch | TorchServe |
Affected:
0 , < *
(semver)
|
Date Public
2026-10-29 15:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123974",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T20:18:09.099163Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T20:18:25.863Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "TorchServe",
"repo": "https://github.com/pytorch/serve",
"vendor": "PyTorch",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Christ Bowel"
}
],
"datePublic": "2026-10-29T15:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In all versions of PyTorch\u0027s TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-379",
"description": "CWE-379 Creation of temporary file in directory with insecure permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:52:16.058Z",
"orgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
"shortName": "Akrites"
},
"references": [
{
"url": "https://christbowel.com/blog/torchserve-lpe/"
},
{
"url": "https://github.com/Christbowel/torchserve-lpe"
}
],
"solutions": [
{
"lang": "en",
"value": "The project is archived and currently no permanent solution is scheduled for release. See workaround section."
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "pytorch/serve: Local privilege escalation through insecure temporary path",
"workarounds": [
{
"lang": "en",
"value": "Three independent fixes:\n\n\n * Set TEMP (or pass -Djava.io.tmpdir) to a directory the service account owns and that is not world-writable.\n * Harden the systemd unit with PrivateTmp=yes, so /tmp is namespaced per service.\n * At the code level, extract into a directory owned by the service account and refuse to reuse a pre-existing extraction root that the service does not own, instead of forceMkdir-ing into whatever is already there."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
"assignerShortName": "Akrites",
"cveId": "CVE-2026-123974",
"datePublished": "2026-11-06T19:52:16.058Z",
"dateReserved": "2026-11-06T17:53:03.966Z",
"dateUpdated": "2026-11-06T20:18:25.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-35199 (GCVE-0-2024-35199)
Vulnerability from nvd – Published: 2024-07-18 22:40 – Updated: 2024-08-07 15:59
VLAI
EPSS
VEX
Title
TorchServe gRPC Port Exposure
Summary
TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed in PR #3083. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-19 16:50 UTC
CWE
- CWE-668 - Exposure of Resource to Wrong Sphere
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pytorch/serve/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pytorch/serve/pull/3083 | x_refsource_MISC |
| https://github.com/pytorch/serve/releases/tag/v0.11.0 | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| pytorch | serve |
Affected:
>= 0.3.0, < 0.11.0
|
|
| pytorch | torchserve |
Affected:
0.3.0 , < 0.11.0
(custom)
cpe:2.3:a:pytorch:torchserve:0.3.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:pytorch:torchserve:0.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "torchserve",
"vendor": "pytorch",
"versions": [
{
"lessThan": "0.11.0",
"status": "affected",
"version": "0.3.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35199",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-19T16:50:48.409416Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-19T16:57:14.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:07:46.885Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w"
},
{
"name": "https://github.com/pytorch/serve/pull/3083",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/pull/3083"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.11.0",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.11.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "serve",
"vendor": "pytorch",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.3.0, \u003c 0.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed in PR #3083. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T15:59:53.795Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w"
},
{
"name": "https://github.com/pytorch/serve/pull/3083",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/pull/3083"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.11.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.11.0"
}
],
"source": {
"advisory": "GHSA-hhpg-v63p-wp7w",
"discovery": "UNKNOWN"
},
"title": "TorchServe gRPC Port Exposure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-35199",
"datePublished": "2024-07-18T22:40:06.549Z",
"dateReserved": "2024-05-10T14:24:24.343Z",
"dateUpdated": "2024-08-07T15:59:53.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-35198 (GCVE-0-2024-35198)
Vulnerability from nvd – Published: 2024-07-18 22:40 – Updated: 2024-08-07 16:00
VLAI
EPSS
VEX
Title
TorchServe bypass allowed_urls configuration
Summary
TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which effectively bypasses the allowed_urls security check. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed by validating the URL without characters such as ".." before downloading see PR #3082. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-19 16:58 UTC
CWE
- CWE-706 - Use of Incorrectly-Resolved Name or Reference
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pytorch/serve/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pytorch/serve/pull/3082 | x_refsource_MISC |
| https://github.com/pytorch/serve/releases/tag/v0.11.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-19T16:58:05.654373Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-19T16:58:12.450Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:07:46.750Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2"
},
{
"name": "https://github.com/pytorch/serve/pull/3082",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/pull/3082"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.11.0",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.11.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "serve",
"vendor": "pytorch",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.4.2, \u003c 0.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe \u0027s check on allowed_urls configuration can be by-passed if the URL contains characters such as \"..\" but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which effectively bypasses the allowed_urls security check. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed by validating the URL without characters such as \"..\" before downloading see PR #3082. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-706",
"description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T16:00:46.093Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2"
},
{
"name": "https://github.com/pytorch/serve/pull/3082",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/pull/3082"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.11.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.11.0"
}
],
"source": {
"advisory": "GHSA-wxcx-gg9c-fwp2",
"discovery": "UNKNOWN"
},
"title": "TorchServe bypass allowed_urls configuration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-35198",
"datePublished": "2024-07-18T22:40:08.176Z",
"dateReserved": "2024-05-10T14:24:24.343Z",
"dateUpdated": "2024-08-07T16:00:46.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-48299 (GCVE-0-2023-48299)
Vulnerability from nvd – Published: 2023-11-21 20:55 – Updated: 2024-08-02 21:23
VLAI
EPSS
VEX
Title
TorchServe ZipSlip
Summary
TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them. TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability.
Severity
5.3 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pytorch/serve/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pytorch/serve/pull/2634 | x_refsource_MISC |
| https://github.com/pytorch/serve/commit/bfb3d4239… | x_refsource_MISC |
| https://github.com/pytorch/serve/releases/tag/v0.9.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:23:39.504Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jp",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jp"
},
{
"name": "https://github.com/pytorch/serve/pull/2634",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/pull/2634"
},
{
"name": "https://github.com/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bb",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bb"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.9.0",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.9.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "serve",
"vendor": "pytorch",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 0.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them. TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-21T20:55:59.504Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jp"
},
{
"name": "https://github.com/pytorch/serve/pull/2634",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/pull/2634"
},
{
"name": "https://github.com/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bb"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.9.0"
}
],
"source": {
"advisory": "GHSA-m2mj-pr4f-h9jp",
"discovery": "UNKNOWN"
},
"title": "TorchServe ZipSlip"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-48299",
"datePublished": "2023-11-21T20:55:59.504Z",
"dateReserved": "2023-11-14T17:41:15.571Z",
"dateUpdated": "2024-08-02T21:23:39.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-43654 (GCVE-0-2023-43654)
Vulnerability from nvd – Published: 2023-09-28 22:10 – Updated: 2025-02-13 17:13Title
TorchServe Server-Side Request Forgery
Summary
TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-23 18:11 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pytorch/serve/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pytorch/serve/pull/2534 | x_refsource_MISC |
| https://github.com/pytorch/serve/releases/tag/v0.8.2 | x_refsource_MISC |
| http://packetstormsecurity.com/files/175095/PyTor… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| pytorch | serve |
Affected:
>= 0.1.0, < 0.8.2
|
|
| pytorch | torchserve |
Affected:
0.1.0 , < 0.8.2
(custom)
cpe:2.3:a:pytorch:torchserve:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:44:43.856Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w"
},
{
"name": "https://github.com/pytorch/serve/pull/2534",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/pull/2534"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.8.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.8.2"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:pytorch:torchserve:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "torchserve",
"vendor": "pytorch",
"versions": [
{
"lessThan": "0.8.2",
"status": "affected",
"version": "0.1.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43654",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-23T18:11:45.025680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-23T18:12:51.982Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "serve",
"vendor": "pytorch",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 0.8.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-13T15:06:29.225Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w"
},
{
"name": "https://github.com/pytorch/serve/pull/2534",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/pull/2534"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.8.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.8.2"
},
{
"url": "http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html"
}
],
"source": {
"advisory": "GHSA-8fxr-qfr9-p34w",
"discovery": "UNKNOWN"
},
"title": "TorchServe Server-Side Request Forgery"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-43654",
"datePublished": "2023-09-28T22:10:09.497Z",
"dateReserved": "2023-09-20T15:35:38.147Z",
"dateUpdated": "2025-02-13T17:13:27.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-123974 (GCVE-0-2026-123974)
Vulnerability from cvelistv5 – Published: 2026-11-06 19:52 – Updated: 2026-11-06 20:18 Unsupported When Assigned
VLAI
EPSS
VEX
Title
pytorch/serve: Local privilege escalation through insecure temporary path
Summary
In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 20:18 UTC
CWE
- CWE-379 - Creation of temporary file in directory with insecure permissions
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PyTorch | TorchServe |
Affected:
0 , < *
(semver)
|
Date Public
2026-10-29 15:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123974",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T20:18:09.099163Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T20:18:25.863Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "TorchServe",
"repo": "https://github.com/pytorch/serve",
"vendor": "PyTorch",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Christ Bowel"
}
],
"datePublic": "2026-10-29T15:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "In all versions of PyTorch\u0027s TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-379",
"description": "CWE-379 Creation of temporary file in directory with insecure permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:52:16.058Z",
"orgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
"shortName": "Akrites"
},
"references": [
{
"url": "https://christbowel.com/blog/torchserve-lpe/"
},
{
"url": "https://github.com/Christbowel/torchserve-lpe"
}
],
"solutions": [
{
"lang": "en",
"value": "The project is archived and currently no permanent solution is scheduled for release. See workaround section."
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "pytorch/serve: Local privilege escalation through insecure temporary path",
"workarounds": [
{
"lang": "en",
"value": "Three independent fixes:\n\n\n * Set TEMP (or pass -Djava.io.tmpdir) to a directory the service account owns and that is not world-writable.\n * Harden the systemd unit with PrivateTmp=yes, so /tmp is namespaced per service.\n * At the code level, extract into a directory owned by the service account and refuse to reuse a pre-existing extraction root that the service does not own, instead of forceMkdir-ing into whatever is already there."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7fefd608-56a6-419f-a002-fd8543c0710a",
"assignerShortName": "Akrites",
"cveId": "CVE-2026-123974",
"datePublished": "2026-11-06T19:52:16.058Z",
"dateReserved": "2026-11-06T17:53:03.966Z",
"dateUpdated": "2026-11-06T20:18:25.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-35198 (GCVE-0-2024-35198)
Vulnerability from cvelistv5 – Published: 2024-07-18 22:40 – Updated: 2024-08-07 16:00
VLAI
EPSS
VEX
Title
TorchServe bypass allowed_urls configuration
Summary
TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which effectively bypasses the allowed_urls security check. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed by validating the URL without characters such as ".." before downloading see PR #3082. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-19 16:58 UTC
CWE
- CWE-706 - Use of Incorrectly-Resolved Name or Reference
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pytorch/serve/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pytorch/serve/pull/3082 | x_refsource_MISC |
| https://github.com/pytorch/serve/releases/tag/v0.11.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-19T16:58:05.654373Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-19T16:58:12.450Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:07:46.750Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2"
},
{
"name": "https://github.com/pytorch/serve/pull/3082",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/pull/3082"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.11.0",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.11.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "serve",
"vendor": "pytorch",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.4.2, \u003c 0.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe \u0027s check on allowed_urls configuration can be by-passed if the URL contains characters such as \"..\" but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which effectively bypasses the allowed_urls security check. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed by validating the URL without characters such as \"..\" before downloading see PR #3082. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-706",
"description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T16:00:46.093Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2"
},
{
"name": "https://github.com/pytorch/serve/pull/3082",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/pull/3082"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.11.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.11.0"
}
],
"source": {
"advisory": "GHSA-wxcx-gg9c-fwp2",
"discovery": "UNKNOWN"
},
"title": "TorchServe bypass allowed_urls configuration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-35198",
"datePublished": "2024-07-18T22:40:08.176Z",
"dateReserved": "2024-05-10T14:24:24.343Z",
"dateUpdated": "2024-08-07T16:00:46.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-35199 (GCVE-0-2024-35199)
Vulnerability from cvelistv5 – Published: 2024-07-18 22:40 – Updated: 2024-08-07 15:59
VLAI
EPSS
VEX
Title
TorchServe gRPC Port Exposure
Summary
TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed in PR #3083. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-19 16:50 UTC
CWE
- CWE-668 - Exposure of Resource to Wrong Sphere
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/pytorch/serve/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pytorch/serve/pull/3083 | x_refsource_MISC |
| https://github.com/pytorch/serve/releases/tag/v0.11.0 | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| pytorch | serve |
Affected:
>= 0.3.0, < 0.11.0
|
|
| pytorch | torchserve |
Affected:
0.3.0 , < 0.11.0
(custom)
cpe:2.3:a:pytorch:torchserve:0.3.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:pytorch:torchserve:0.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "torchserve",
"vendor": "pytorch",
"versions": [
{
"lessThan": "0.11.0",
"status": "affected",
"version": "0.3.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35199",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-19T16:50:48.409416Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-19T16:57:14.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:07:46.885Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w"
},
{
"name": "https://github.com/pytorch/serve/pull/3083",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/pull/3083"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.11.0",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.11.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "serve",
"vendor": "pytorch",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.3.0, \u003c 0.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed in PR #3083. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T15:59:53.795Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w"
},
{
"name": "https://github.com/pytorch/serve/pull/3083",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/pull/3083"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.11.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.11.0"
}
],
"source": {
"advisory": "GHSA-hhpg-v63p-wp7w",
"discovery": "UNKNOWN"
},
"title": "TorchServe gRPC Port Exposure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-35199",
"datePublished": "2024-07-18T22:40:06.549Z",
"dateReserved": "2024-05-10T14:24:24.343Z",
"dateUpdated": "2024-08-07T15:59:53.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-48299 (GCVE-0-2023-48299)
Vulnerability from cvelistv5 – Published: 2023-11-21 20:55 – Updated: 2024-08-02 21:23
VLAI
EPSS
VEX
Title
TorchServe ZipSlip
Summary
TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them. TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability.
Severity
5.3 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pytorch/serve/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pytorch/serve/pull/2634 | x_refsource_MISC |
| https://github.com/pytorch/serve/commit/bfb3d4239… | x_refsource_MISC |
| https://github.com/pytorch/serve/releases/tag/v0.9.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:23:39.504Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jp",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jp"
},
{
"name": "https://github.com/pytorch/serve/pull/2634",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/pull/2634"
},
{
"name": "https://github.com/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bb",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bb"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.9.0",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.9.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "serve",
"vendor": "pytorch",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 0.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them. TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-21T20:55:59.504Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jp"
},
{
"name": "https://github.com/pytorch/serve/pull/2634",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/pull/2634"
},
{
"name": "https://github.com/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bb"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.9.0"
}
],
"source": {
"advisory": "GHSA-m2mj-pr4f-h9jp",
"discovery": "UNKNOWN"
},
"title": "TorchServe ZipSlip"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-48299",
"datePublished": "2023-11-21T20:55:59.504Z",
"dateReserved": "2023-11-14T17:41:15.571Z",
"dateUpdated": "2024-08-02T21:23:39.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-43654 (GCVE-0-2023-43654)
Vulnerability from cvelistv5 – Published: 2023-09-28 22:10 – Updated: 2025-02-13 17:13Title
TorchServe Server-Side Request Forgery
Summary
TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.
Severity
10 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-23 18:11 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pytorch/serve/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pytorch/serve/pull/2534 | x_refsource_MISC |
| https://github.com/pytorch/serve/releases/tag/v0.8.2 | x_refsource_MISC |
| http://packetstormsecurity.com/files/175095/PyTor… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| pytorch | serve |
Affected:
>= 0.1.0, < 0.8.2
|
|
| pytorch | torchserve |
Affected:
0.1.0 , < 0.8.2
(custom)
cpe:2.3:a:pytorch:torchserve:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:44:43.856Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w"
},
{
"name": "https://github.com/pytorch/serve/pull/2534",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/pull/2534"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.8.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.8.2"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:pytorch:torchserve:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "torchserve",
"vendor": "pytorch",
"versions": [
{
"lessThan": "0.8.2",
"status": "affected",
"version": "0.1.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43654",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-23T18:11:45.025680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-23T18:12:51.982Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "serve",
"vendor": "pytorch",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.1.0, \u003c 0.8.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-13T15:06:29.225Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w"
},
{
"name": "https://github.com/pytorch/serve/pull/2534",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/pull/2534"
},
{
"name": "https://github.com/pytorch/serve/releases/tag/v0.8.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pytorch/serve/releases/tag/v0.8.2"
},
{
"url": "http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html"
}
],
"source": {
"advisory": "GHSA-8fxr-qfr9-p34w",
"discovery": "UNKNOWN"
},
"title": "TorchServe Server-Side Request Forgery"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-43654",
"datePublished": "2023-09-28T22:10:09.497Z",
"dateReserved": "2023-09-20T15:35:38.147Z",
"dateUpdated": "2025-02-13T17:13:27.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}