---
id: CVE-2024-12216
aliases:
  - GHSA-m724-hqmc-ggpx
  - PYSEC-2026-1406
title: GluonCV Arbitrary File Write via TarSlip
summary: GluonCV Arbitrary File Write via TarSlip
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'
vendor: gluoncv
product: gluoncv
ecosystem: pip
affected:
  - gluoncv <= 0.10.0
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-m724-hqmc-ggpx'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-12216'
  - url: 'https://github.com/dmlc/gluon-cv'
  - url: >-
      https://github.com/dmlc/gluon-cv/blob/3862e2db33ab650eff7c7c5c5891e805207027b1/gluoncv/utils/filesystem.py#L223-L229
  - url: 'https://huntr.com/bounties/46081fdc-2951-4deb-a2c9-2627007bdce0'
tags:
  - osv
  - pip
epss: 0.00306
epssPercentile: 0.2087
ingestedAt: '2026-07-08T18:25:51.159Z'
---

## Overview

A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.

## Affected packages

- `gluoncv <= 0.10.0`

## Remediation

Refer to the advisory for the patched release.