TI-2024-06801 Aliases CVE-2024-7340 GHSA-r49h-6qxq-624f

W&B Weave server remote arbitrary file leak and privilege escalation

MEDIUM 48CWE-22Published 2024-07-31 · Updated 2024-11-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.05015 92nd percentileScored 2026-11-07

Fix Fixed weave (PyPI): 0.50.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	weave	up to 0.50.7	—	No fix listed	CNA
—	weave (PyPI)	before 0.50.8	0.50.8	Patch available	GHSA-r49h-6qxq-624f

weave Vendor— Affected up to 0.50.7 Fixed in — No fix listed CNA
weave (PyPI) Vendor— Affected before 0.50.8 Fixed in 0.50.8 Patch available GHSA-r49h-6qxq-624f

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:weights_\&_biases:weave::::::::	—	—	—

cpe:2.3:a:weights_\&_biases:weave:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · GHSA-r49h-6qxq-624f weave (PyPI) Fixed in 0.50.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-7340
2026-10-03 Alias added: GHSA-r49h-6qxq-624f

References

Patch 1

https://github.com/wandb/weave/pull/1657

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences