CVE-2024-5980

CVE-2024-5980 is a critical path traversal vulnerability affecting the /v1/runs API endpoint in lightning-ai/pytorch-lightning v2.2.4. Attackers can exploit this flaw when the LightningApp uses the plugin_server, deploying malicious tar.gz plugins to write arbitrary files to any directory on the victim's system. This can lead to remote code execution, as indicated by its CVSS score of 9.8 (CRITICAL) with a low attack complexity and no user interaction required. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, with 10 mentions, suggesting awareness and potential future exploitation.