{"id":"CVE-2024-1603","aliases":["EUVD-2024-0954","GHSA-jwrc-3v3f-5cq5","PYSEC-2026-1755"],"status":"published","title":"confirmed","description":"paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.","severity":{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00564,"percentile":0.47184,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-73"],"published":"2024-03-23T18:24:29Z","modified":"2026-10-28T02:31:06Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"paddlepaddle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"paddlepaddle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.0"}]}],"versions":["1.8.5"]},{"source":"osv","ecosystem":"PyPI","package":"paddlepaddle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.0"}]}],"versions":["1.8.5"]}],"products":[{"vendor":"paddlepaddle","product":"paddle"},{"vendor":"paddlepaddle","product":"paddlepaddle"},{"vendor":"paddlepaddle","product":"paddlepaddle/paddle"}],"references":[{"url":"https://huntr.com/bounties/7739eced-73a3-4a96-afcd-9c753c55929e","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1603","tags":["advisory"]},{"url":"https://github.com/PaddlePaddle/Paddle/blob/release/2.6/python/paddle/vision/ops.py#L1262","tags":["web"]},{"url":"https://github.com/PaddlePaddle/Paddle/blob/release/2.6/python/paddle/vision/ops.py#L1295-L1334","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jwrc-3v3f-5cq5","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1603.json","tags":["advisory"]},{"url":"https://github.com/PaddlePaddle/Paddle","tags":["package"]},{"url":"https://pypi.org/project/paddlepaddle","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-1603","title":"confirmed","description":"paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.","status":"published","published":"2024-03-23T18:24:29.431Z","modified":"2025-02-13T17:32:18.811Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:34:18.259965Z"}],"euvd":[{"id":"EUVD-2024-0954","description":"paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.","status":"published","published":"2024-03-23T18:24:29Z","modified":"2025-02-13T17:32:18Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T00:03:47.607822Z"}],"ghsa":[{"id":"GHSA-jwrc-3v3f-5cq5","title":"PaddlePaddle allows arbitrary file read via paddle.vision.ops.read_file","description":"paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.","status":"published","published":"2024-03-23T21:30:39Z","modified":"2025-01-24T20:19:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:38:28.945236Z"}],"nvd":[{"id":"CVE-2024-1603","description":"paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.","status":"published","published":"2024-03-23T19:15:07.283Z","modified":"2026-06-17T07:04:37.263Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"CVE-2024-1603","title":"confirmed","description":"paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.","status":"published","published":"2024-03-23T18:24:29.431Z","modified":"2026-10-28T02:31:06.87786726Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"GHSA-jwrc-3v3f-5cq5","title":"PaddlePaddle allows arbitrary file read via paddle.vision.ops.read_file","description":"paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.","status":"published","published":"2024-03-23T21:30:39Z","modified":"2026-09-10T03:50:10.687290882Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"PYSEC-2026-1755","title":"PaddlePaddle allows arbitrary file read via paddle.vision.ops.read_file","description":"paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.","status":"published","published":"2026-07-07T11:45:36.342486Z","modified":"2026-07-07T17:47:47.645685794Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"}]}}