{"id":"CVE-2024-12216","aliases":["GHSA-m724-hqmc-ggpx","PYSEC-2026-1406"],"title":"GluonCV Arbitrary File Write via TarSlip","summary":"GluonCV Arbitrary File Write via TarSlip","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","vendor":"gluoncv","product":"gluoncv","ecosystem":"pip","affected":["gluoncv <= 0.10.0"],"published":"2025-03-20","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-m724-hqmc-ggpx","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12216"},{"url":"https://github.com/dmlc/gluon-cv"},{"url":"https://github.com/dmlc/gluon-cv/blob/3862e2db33ab650eff7c7c5c5891e805207027b1/gluoncv/utils/filesystem.py#L223-L229"},{"url":"https://huntr.com/bounties/46081fdc-2951-4deb-a2c9-2627007bdce0"}],"tags":["osv","pip"],"epss":0.00306,"epssPercentile":0.23593,"ingestedAt":"2026-07-08T18:25:51.159Z","slug":"CVE-2024-12216","body":"## Overview\n\nA vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.\n\n## Affected packages\n\n- `gluoncv <= 0.10.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}