PaddlePaddle command injection in paddle.utils.download._wget_download

Command injection in paddle.utils.download.wgetdownload bypass filter in paddlepaddle/paddle 2.6.0...

PYSEC-2026-1756 PaddlePaddle command injection in paddle.utils.download._wget_download

Command injection in paddle.utils.download.wgetdownload bypass filter in paddlepaddle/paddle 2.6.0...

The vulnerability of the GNU Wget2 download manager, related to incorrect path name restrictions for restricted directories, allows a perpetrator to expose protected information and compromise the system.

The vulnerability of the GNU Wget2 download manager is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information and compromise the system...

PT-2024-14518 · Unknown · Paddlepaddle

Name of the Vulnerable Software and Affected Versions: PaddlePaddle versions prior to 2.6.0 Description: The issue is a command injection in the wget download function, allowing the execution of arbitrary commands on the operating system. Recommendations: For versions prior to 2.6.0, update to...