Path Traversal

TorchServe is vulnerable to Path Traversal. The vulnerability is due to inadequate validation of URLs in the allowedurls configuration, which bypasses the security checks by including characters such as "..", resulting in the model from being downloaded into the model store...

PT-2024-26375 · Unknown · Torchserve

Name of the Vulnerable Software and Affected Versions: TorchServe versions prior to 0.11.0 Description: The issue concerns TorchServe's check on allowed urls configuration, which can be bypassed if the URL contains characters such as "..". This allows a model to be downloaded into the model store...