CVE-2024-9363 Unauthorized File Deletion in polyaxon/polyaxon
An attacker can delete critical files in Polyaxon containers without authentication, causing denial of service by terminating API services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9363?
CVE-2024-9363 is a high-severity path traversal vulnerability in polyaxon/polyaxon, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthorized file deletion vulnerability exists in the latest version of the Polyaxon platform, which can lead to denial of service by terminating critical containers. An attacker can delete important files within the containers, such as `polyaxon.sock`, causing the API container to exit unexpectedly. This disrupts related services and prevents the system from functioning normally, without requiring authentication or UUID parameters.
Weakness: CWE-23
Which versions are affected by CVE-2024-9363?
How do I fix CVE-2024-9363?
No fix has been published for CVE-2024-9363 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-9363 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-9363 exists.
Sources
Also known as GHSA-m47g-ghr5-3734.