CVE-2024-8019

⛔ critical

Summary

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations.

CVSS Score

9.1

Critical

EPSS Score

1.0

Exploit Probability

Published Date

2025-03-20

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 87.7% of all 328,009 vulnerabilities in our database.

#40,306

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Mar 20, 2025

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2025-08-01

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE IDs (Weakness Types)

CWE-434

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
lightningai	pytorch_lightning	Affected	v2.3.2

🔗 References 2

https://github.com/lightning-ai/pytorch-lightning/co...

Patch

https://huntr.com/bounties/2754298b-5af5-48ef-8b38-9...

Exploit Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-44484	⛔ critical	9.8	0.1	PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introdu...	2026-05-14
CVE-2026-31221	⚠️ high	7.8	0.2	PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoi...	2026-05-12
CVE-2024-8020	⚠️ high	7.5	0.1	A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sendi...	2025-03-20
CVE-2024-5980	⛔ critical	9.8	10.7	A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path t...	2024-06-27
CVE-2024-5452	⛔ critical	9.8	56.7	A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to im...	2024-06-06
CVE-2022-0845	⛔ critical	9.8	0.3	Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.	2022-03-05

These CVEs affect the same products