Read the docs
TI-2023-26162 Aliases CVE-2023-48299GHSA-m2mj-pr4f-h9jp

TorchServe ZipSlip

Priority LOW 25CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them. TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability.

Why it matters now

EPSS 0.00679 52nd percentileScored 2026-11-07
Fix Fixed serve (pytorch): 0.9.0torchserve (PyPI): 0.9.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
pytorchserve0.1.0 to before 0.9.00.9.0Patch availableCNA
—torchserve (PyPI)0.1.0 to before 0.9.00.9.0Patch availableGHSA-m2mj-pr4f-h9jp
  • serve Vendorpytorch Affected 0.1.0 to before 0.9.0 Fixed in 0.9.0 Patch available CNA
  • torchserve (PyPI) Vendor— Affected 0.1.0 to before 0.9.0 Fixed in 0.9.0 Patch available GHSA-m2mj-pr4f-h9jp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pytorch:torchserve:*:*:*:*:*:*:*:*0.1.0 to before 0.9.0Vulnerablepytorch
  • cpe:2.3:a:pytorch:torchserve:*:*:*:*:*:*:*:* Versions 0.1.0 to before 0.9.0 Vulnerable ·pytorch

Remediation

  • Fix · CNA serve (pytorch) Fixed in 0.9.0
  • Fix · GHSA-m2mj-pr4f-h9jp torchserve (PyPI) Fixed in 0.9.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-48299
  2. 2026-10-03 Alias added: GHSA-m2mj-pr4f-h9jp

References

Patch 3

Advisory 1

Other 2

  • TI-2023-23379 TorchServe Server-Side Request Forgery CVSS 3.1CRITICAL 10.0
  • TI-2024-23271 TorchServe gRPC Port Exposure CVSS 3.1HIGH 8.2
  • TI-2024-23270 TorchServe bypass allowed_urls configuration CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences