| タイトル | mosaicml composer 0.32.1 Path Traversal |
|---|
| 説明 | mosaicml composer up to 0.32.1 is vulnerable to path traversal (tar-slip) during checkpoint loading (CWE-22). The checkpoint extraction uses os.path.join(local_path, os.path.relpath(...)) without any containment check, allowing a malicious checkpoint file to write arbitrary files outside the target directory on worker nodes. In distributed training environments, this may lead to file overwrite on all training nodes. CVSS 8.9 High (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Researcher: mohammad adnan (cystack.ps redteam). |
|---|
| ソース | ⚠️ https://github.com/mosaicml/composer/issues/3942 |
|---|
| ユーザー | Anonymous User |
|---|
| 送信 | 2026年09月15日 00:25 (28 日 ago) |
|---|
| モデレーション | 2026年10月12日 13:44 (28 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 416887 [MosaicML Composer 迄 0.32.1 Checkpoint Extraction checkpoint.py tarball.extractall ディレクトリトラバーサル] |
|---|
| ポイント | 20 |
|---|