AVID-2026-R1470

Description

Kohya_ss vulnerable to path injection in common_gui.py find_and_replace function (GHSL-2024-024) (CVE-2024-32023)

Details

Kohya_ss is a GUI for Kohya’s Stable Diffusion trainers. Kohya_ss is vulnerable to a path injection in the common_gui.py find_and_replace function. This vulnerability is fixed in 23.1.5.

Reason for inclusion in AVID: CVE-2024-32023 describes a path traversal vulnerability in kohya_ss GUI used for Stable Diffusion trainer workflows. This is a software vulnerability affecting a tool commonly used in AI model training pipelines, i.e., part of the AI software supply chain. It targets a software component (training tooling) rather than hardware/firmware. The CVE, CWE-22, and public advisories provide clear evidence of a security vulnerability within AI-related tooling.

References

Affected or Relevant Artifacts

Developer: bmaltais
Deployer: bmaltais
Artifact Details:

Type	Name
System	kohya_ss

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Base Score	6.5
Base Severity	🟠 Medium
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🟢 Low
Integrity Impact	🟢 Low
Availability Impact	NONE

CWE

ID	Description
CWE-22	CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2024-04-16
Version: 0.3.3
AVID Entry