Path Traversal

TorchServe is vulnerable to Path Traversal. The vulnerability is due to inadequate validation of URLs in the allowedurls configuration, which bypasses the security checks by including characters such as "..", resulting in the model from being downloaded into the model store...

CVE-2024-35198: Use of Incorrectly-Resolved Name or Reference

TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowedurls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a fi...

PT-2024-26375

Name of the Vulnerable Software and Affected Versions TorchServe versions prior to 0.11.0 Description The issue concerns TorchServe's check on allowed urls configuration, which can be bypassed if the URL contains characters such as "..". This allows a model to be downloaded into the model store,...