CVE-2023-48299 TorchServe ZipSlip

What is CVE-2023-48299?

CVE-2023-48299 is a medium-severity path traversal vulnerability in pytorch serve, published on 21 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them. TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability.

Weakness: CWE-22

Which versions are affected by CVE-2023-48299?

3 open source packages ship an affected version, including torchserve. It affects 1 product.

Products include Pytorch Torchserve.

How do I fix CVE-2023-48299?

Upgrade torchserve to 0.9.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-48299 being exploited?

There is no known exploitation of CVE-2023-48299 in the wild and no public exploit code.

Other vulnerabilities in pytorch serve

• CVE-2023-43654 TorchServe Server-Side Request Forgery Critical 10.0
• CVE-2024-35198 TorchServe bypass allowed_urls configuration Critical 9.8
• CVE-2024-35199 TorchServe gRPC Port Exposure High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m2mj-pr4f-h9jp, PYSEC-2026-1972.