Home » Database

AVID-2026-R1399

Description

confirmed (CVE-2024-1603)

Details

paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.

Reason for inclusion in AVID: The CVE describes a vulnerability in PaddlePaddle (an AI framework) that enables arbitrary file read via paddle.vision.ops.read_file. This affects a software component commonly used to build/train/deploy AI systems, i.e., a dependency in AI pipelines, which constitutes a software supply chain issue for general-purpose AI systems. The vulnerability is clearly security-related (CVE, CVSS shows confidentiality impact), and there is sufficient evidence in the report to classify it. Therefore it should be kept for AVID curation.

References

Affected or Relevant Artifacts

  • Developer: paddlepaddle
  • Deployer: paddlepaddle
  • Artifact Details:
TypeName
Systempaddlepaddle/paddle

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Base Score8.2
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🟢 Low
Availability ImpactNONE

CWE

IDDescription
CWE-73CWE-73 External Control of File Name or Path

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-03-23
  • Version: 0.3.3
  • AVID Entry