CVE-2023-48299 json
TorchServe ZipSlip
published 2023-11-21 2 y ago modified 2026-09-10 1 mo ago also GHSA-m2mj-pr4f-h9jp , PYSEC-2026-1972 , EUVD-2023-2995
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them. TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability.
Patch / fix
- pypi torchserve 0.9.0
- pytorch torchserve 0.9.0
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | torchserve | >=0.1.0, <0.9.0 |
0.9.0 |
Affected products
- pytorch serve
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/pytorch/serve/pull/2634
web, patch
-
github.com
/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bb
web, patch
-
github.com
/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jp
web, patch, vendor-advisory
-
github.com
/pytorch/serve/releases/tag/v0.9.0
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-48299
advisory
-
github.com
/pytorch/serve
package
-
pypi.org
/project/torchserve
package
-
github.com
/advisories/GHSA-m2mj-pr4f-h9jp
advisory
Sources
- CVE List CVE-2023-48299
- GitHub Advisory GHSA-m2mj-pr4f-h9jp
- NVD CVE-2023-48299
- OSV PYSEC-2026-1972
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.