| 标题 | mosaicml composer 0.32.1 Path Traversal |
|---|
| 描述 | mosaicml composer up to 0.32.1 is vulnerable to path traversal (tar-slip) during checkpoint loading (CWE-22). The checkpoint extraction uses os.path.join(local_path, os.path.relpath(...)) without any containment check, allowing a malicious checkpoint file to write arbitrary files outside the target directory on worker nodes. In distributed training environments, this may lead to file overwrite on all training nodes. CVSS 8.9 High (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Researcher: mohammad adnan (cystack.ps redteam). |
|---|
| 来源 | ⚠️ https://github.com/mosaicml/composer/issues/3942 |
|---|
| 用户 | Anonymous User |
|---|
| 提交 | 2026-09-15 00時25分 (30 日前) |
|---|
| 管理 | 2026-10-12 13時44分 (28 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 416887 [MosaicML Composer 直到 0.32.1 Checkpoint Extraction checkpoint.py tarball.extractall 目录遍历] |
|---|
| 积分 | 20 |
|---|