CVE-2024-6868

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-6868", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2024-07-17T21:19:44.930Z", "datePublished": "2024-10-29T12:46:54.732Z", "dateUpdated": "2025-10-15T12:49:47.751Z"}, "containers": {"cna": {"title": "Arbitrary File Write in mudler/LocalAI", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2025-10-15T12:49:47.751Z"}, "descriptions": [{"lang": "en", "value": "mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives (e.g., .tar), these archives are automatically extracted after downloading. This behavior can be exploited to perform a 'tarslip' attack, allowing files to be written to arbitrary locations on the server, bypassing checks that normally restrict files to the models directory. This vulnerability can lead to remote code execution (RCE) by overwriting backend assets used by the server."}], "affected": [{"vendor": "mudler", "product": "mudler/localai", "versions": [{"version": "unspecified", "lessThan": "2.18.1", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/752d2376-2d9a-4e17-b462-3c267f9dd229"}, {"url": "https://github.com/mudler/localai/commit/a181dd0ebc5d3092fc50f61674d552604fe8ef9c"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-59 Improper Link Resolution Before File Access", "cweId": "CWE-59"}]}], "source": {"advisory": "752d2376-2d9a-4e17-b462-3c267f9dd229", "discovery": "EXTERNAL"}}, "adp": [{"affected": [{"vendor": "mudler", "product": "localai", "cpes": ["cpe:2.3:a:mudler:localai:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.18.1", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-29T13:19:07.645269Z", "id": "CVE-2024-6868", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T13:33:58.219Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6868", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-29T13:19:07.645269Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mudler:localai:*:*:*:*:*:*:*:*"], "vendor": "mudler", "product": "localai", "versions": [{"status": "affected", "version": "0", "lessThan": "2.18.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T13:33:51.795Z"}}], "cna": {"title": "Arbitrary File Write in mudler/LocalAI", "source": {"advisory": "752d2376-2d9a-4e17-b462-3c267f9dd229", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "mudler", "product": "mudler/localai", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "2.18.1", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/752d2376-2d9a-4e17-b462-3c267f9dd229"}, {"url": "https://github.com/mudler/localai/commit/a181dd0ebc5d3092fc50f61674d552604fe8ef9c"}], "descriptions": [{"lang": "en", "value": "mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives (e.g., .tar), these archives are automatically extracted after downloading. This behavior can be exploited to perform a 'tarslip' attack, allowing files to be written to arbitrary locations on the server, bypassing checks that normally restrict files to the models directory. This vulnerability can lead to remote code execution (RCE) by overwriting backend assets used by the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-10-29T12:46:54.732Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6868", "state": "PUBLISHED", "dateUpdated": "2024-10-29T13:33:58.219Z", "dateReserved": "2024-07-17T21:19:44.930Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2024-10-29T12:46:54.732Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "mudler/localai", "vendor": "mudler", "versions": [{"lessThan": "2.18.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@huntr.dev"}, {"affectedData": [{"cpes": ["cpe:2.3:a:mudler:localai:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "localai", "vendor": "mudler", "versions": [{"lessThan": "2.18.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mudler:localai:2.17.1:*:*:*:*:*:*:*", "matchCriteriaId": "CDCAF2D5-46FD-4D8E-B65B-9BE9FDD5D686", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives (e.g., .tar), these archives are automatically extracted after downloading. This behavior can be exploited to perform a 'tarslip' attack, allowing files to be written to arbitrary locations on the server, bypassing checks that normally restrict files to the models directory. This vulnerability can lead to remote code execution (RCE) by overwriting backend assets used by the server."}, {"lang": "es", "value": "La versi\u00f3n 2.17.1 de mudler/LocalAI permite la escritura arbitraria de archivos debido al manejo inadecuado de la extracci\u00f3n autom\u00e1tica de archivos. Cuando las configuraciones de modelos especifican archivos adicionales como archivos (por ejemplo, .tar), estos archivos se extraen autom\u00e1ticamente despu\u00e9s de la descarga. Este comportamiento se puede aprovechar para realizar un ataque \"tarslip\", que permite escribir archivos en ubicaciones arbitrarias en el servidor, evitando las comprobaciones que normalmente restringen los archivos al directorio de modelos. Esta vulnerabilidad puede provocar la ejecuci\u00f3n remota de c\u00f3digo (RCE) al sobrescribir los activos del backend utilizados por el servidor."}], "id": "CVE-2024-6868", "lastModified": "2026-06-17T08:18:52.407", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-6868", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-29T13:19:07.645269Z", "version": "2.0.3"}}]}, "published": "2024-10-29T13:15:08.473", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/mudler/localai/commit/a181dd0ebc5d3092fc50f61674d552604fe8ef9c"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Third Party Advisory"], "url": "https://huntr.com/bounties/752d2376-2d9a-4e17-b462-3c267f9dd229"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security@huntr.dev", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{}