CVE-2024-12216
Arbitrary File Write via TarSlip in dmlc/gluon-cv
A vulnerability in the ImageClassificationDataset.from_csv() API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Arbitrary File Write via TarSlip in dmlc/gluon-cv
A vulnerability in the ImageClassificationDataset.from_csv() API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.
- Record
CVE-2024-12216- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
EUVDEUVD-2025-7031
A vulnerability in the ImageClassificationDataset.from_csv() API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.
- Record
EUVD-2025-7031- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m724-hqmc-ggpx
GluonCV Arbitrary File Write via TarSlip
A vulnerability in the ImageClassificationDataset.from_csv() API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.
- Record
GHSA-m724-hqmc-ggpx- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-20, CWE-22, CWE-59
- Updated
- 2026-11-02
NVD
A vulnerability in the ImageClassificationDataset.from_csv() API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.
- Record
CVE-2024-12216- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVGHSA-m724-hqmc-ggpx
GluonCV Arbitrary File Write via TarSlip
A vulnerability in the ImageClassificationDataset.from_csv() API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.
- Record
GHSA-m724-hqmc-ggpx- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-20, CWE-22, CWE-59
- Updated
- 2026-11-02
OSVPYSEC-2026-1406
GluonCV Arbitrary File Write via TarSlip
A vulnerability in the ImageClassificationDataset.from_csv() API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.
- Record
PYSEC-2026-1406- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gluoncvPyPI |
through 0.10.0 | None known |
gluoncvPyPI |
through 0.10.0, plus listed versions 0.1.00.10.0b202012030.10.0b202012040.10.0b202012050.10.0b20201206 Show 45 moreShow less0.10.0b202012070.10.0b202012080.10.0b202012090.10.0b202012100.10.0b202012110.10.0b202012120.10.0b202012130.10.0b202012140.10.0b202012150.10.0b202012160.10.0b202012170.10.0b202012180.10.0b202012190.10.0b202012200.10.0b202012210.10.0b202012220.10.0b202012230.10.0b202012240.10.0b202012250.10.0b202012260.10.0b202012270.10.0b202012280.10.0b202012290.10.0b202012300.10.0b202012310.10.0b202101010.10.0b202101020.10.0b202101030.10.0b202101040.10.0b202101050.10.0b202101060.10.0b202101070.10.0b202101080.10.0b202101090.10.0b202101100.10.0b202101110.10.0b202101120.10.0b202101130.10.0b202101140.10.0b202101150.10.0b202101160.10.0b202101170.10.0b202101180.10.0b202101190.10.0b20210120 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-12216 is a high vulnerability (CVSS 7.1) in Dmlc Dmlc/gluon-cv, published March 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. No source names a fixed version.
References
Left out here: 974 versions. The JSON record has them.