TI-2024-06369 Aliases CVE-2024-6868 GHSA-2w8h-hch2-v23h

Arbitrary File Write in mudler/LocalAI

HIGH 75CWE-59Published 2024-10-29 · Updated 2025-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives (e.g., .tar), these archives are automatically extracted after downloading. This behavior can be exploited to perform a 'tarslip' attack, allowing files to be written to arbitrary locations on the server, bypassing checks that normally restrict files to the models directory. This vulnerability can lead to remote code execution (RCE) by overwriting backend assets used by the server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01544 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed mudler/localai (mudler): 2.18.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mudler	mudler/localai	before 2.18.1	2.18.1	Patch available	CNA

mudler/localai Vendormudler Affected before 2.18.1 Fixed in 2.18.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mudler:localai:2.17.1:::::::*	2.17.1	Vulnerable	mudler

cpe:2.3:a:mudler:localai:2.17.1:*:*:*:*:*:*:* Versions 2.17.1 Vulnerable ·mudler

Remediation

Fix · CNA mudler/localai (mudler) Fixed in 2.18.1

Timeline

2026-10-02 Threatist record created from CVE-2024-6868
2026-10-03 Alias added: GHSA-2w8h-hch2-v23h

References

Exploit 1

https://huntr.com/bounties/752d2376-2d9a-4e17-b462-3c267f9dd229

Patch 1

https://github.com/mudler/localai/commit/a181dd0ebc5d3092fc50f61674d552604fe8ef9c

TI-2024-04809 Command Injection in mudler/localai CVSS 3.0CRITICAL 9.8
TI-2024-01889 Command Injection in mudler/localai CVSS 3.0CRITICAL 9.8
TI-2024-04810 Path Traversal in mudler/localai CVSS 3.1CRITICAL 9.1
TI-2024-06481 Remote Code Execution in mudler/localai CVSS 3.0HIGH 8.8
TI-2024-06505 Timing Attack in mudler/localai CVSS 3.1MEDIUM 5.9
TI-2024-05648 SSRF and Partial LFI in /models/apply Endpoint in mudler/localai CVSS 3.1MEDIUM 5.8

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences