| Название | mosaicml composer 0.32.1 Path Traversal |
|---|
| Описание | mosaicml composer up to 0.32.1 is vulnerable to path traversal (tar-slip) during checkpoint loading (CWE-22). The checkpoint extraction uses os.path.join(local_path, os.path.relpath(...)) without any containment check, allowing a malicious checkpoint file to write arbitrary files outside the target directory on worker nodes. In distributed training environments, this may lead to file overwrite on all training nodes. CVSS 8.9 High (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Researcher: mohammad adnan (cystack.ps redteam). |
|---|
| Источник | ⚠️ https://github.com/mosaicml/composer/issues/3942 |
|---|
| Пользователь | Anonymous User |
|---|
| Представление | 15.09.2026 00:25 (28 дни назад) |
|---|
| Модерация | 12.10.2026 13:44 (28 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 416887 [MosaicML Composer до 0.32.1 Checkpoint Extraction checkpoint.py tarball.extractall обход каталога] |
|---|
| Баллы | 20 |
|---|