CVE-2024-2914

A TarSlip vulnerability exists in the deepjavalibrary/djl, affecting version 0.26.0 and fixed in version 0.27.0. This vulnerability allows an attacker to manipulate file paths within tar archives to overwrite arbitrary files on the target system. Exploitation of this vulnerability could lead to remote code execution, privilege escalation, data theft or manipulation, and denial of service. The vulnerability is due to improper validation of file paths during the extraction of tar files, as demonstrated in multiple occurrences within the library's codebase, including but not limited to the files_util.py and extract_imagenet.py scripts.

• CWE-29
• CWE-22

• https://github.com/deepjavalibrary/djl/commit/5235be508cec9e8cb6f496a4ed2fa40e4f62c370Patch
• https://huntr.com/bounties/b064bd2f-bf6e-4fc0-898e-7d02a9b97e24Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/deepjavalibrary/djl/commit/5235be508cec9e8cb6f496a4ed2fa40e4f62c370Patch
• https://huntr.com/bounties/b064bd2f-bf6e-4fc0-898e-7d02a9b97e24Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29134Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-29135Unrestricted Upload of File with Dangerous Type vulnerabilit…8.8
• CVE-2024-29136Deserialization of Untrusted Data vulnerability in Themefic …8.8
• CVE-2024-29137Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2024-29138Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2024-29139Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2024-29140Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2024-29141Improper Neutralization of Input During Web Page Generation …5.5
• CVE-2024-29142Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2024-29143Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2024-29146User passwords are decrypted and stored on memory before any…5.9
• CVE-2024-29149An issue was discovered in Alcatel-Lucent ALE NOE deskphones…7.4