Path Traversal Vulnerability in Gluon-cv Image Classification Dataset API

CVE-2024-12216

What is CVE-2024-12216?

A vulnerability in the ImageClassificationDataset.from_csv() API of the dmlc/gluon-cv library version 0.10.0 poses a risk of arbitrary file writing. The vulnerability arises from the API's incapacity to properly sanitize URLs while downloading and extracting tar.gz files. Malicious actors can exploit this flaw by crafting specially designed tar files, which, when processed, could override crucial files on the target system using path traversal techniques or deceptive symlinks. This could result in unauthorized access to sensitive data or complete takeover of the victim's environment.

References