CVE-2023-48299

TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them. TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability.

• CWE-22

• https://github.com/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bbPatch
• https://github.com/pytorch/serve/pull/2634Patch
• https://github.com/pytorch/serve/releases/tag/v0.9.0Release Notes
• https://github.com/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jpPatch, Vendor Advisory
• https://github.com/pytorch/serve/commit/bfb3d42396727614aef625143b4381e64142f9bbPatch
• https://github.com/pytorch/serve/pull/2634Patch
• https://github.com/pytorch/serve/releases/tag/v0.9.0Release Notes
• https://github.com/pytorch/serve/security/advisories/GHSA-m2mj-pr4f-h9jpPatch, Vendor Advisory

Published

Nov 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-48293The XWiki Admin Tools Application provides tools to help the…8.8
• CVE-2023-48294LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…4.3
• CVE-2023-48295LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…5.4
• CVE-2023-48296OroPlatform is a PHP Business Application Platform (BAP). N…4.3
• CVE-2023-48297Discourse is a platform for community discussion. The messag…7.5
• CVE-2023-48298ClickHouse® is an open-source column-oriented database manag…7.5
• CVE-2023-4830Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-48300The `Embed Privacy` plugin for WordPress that prevents the l…5.4
• CVE-2023-48301Nextcloud Server provides data storage for Nextcloud, an ope…5.4
• CVE-2023-48302Nextcloud Server provides data storage for Nextcloud, an ope…5.4
• CVE-2023-48303Nextcloud Server provides data storage for Nextcloud, an ope…2.7
• CVE-2023-48304Nextcloud Server provides data storage for Nextcloud, an ope…4.3