CVE-2024-5980: pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities.
Published Jun 27, 2024 · Updated Oct 15, 2025
Affected packages
lightning
- Ecosystem
- PyPI
- Affected
- <= 2.3.1
- Fixed in
- 2.3.3
- Check
pip show lightning
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
Credited to awaelchli.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-5980
- https://huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3
- https://github.com/Lightning-AI/pytorch-lightning/pull/20039
- https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.3.3
- https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a
- https://github.com/advisories/GHSA-mr7h-w2qc-ffc2
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology