Quick answers
- Is CVE-2024-0818 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-0818 being exploited in the wild.
- How severe is CVE-2024-0818?
- Low severity, with a CVSS score of 3.1, published 29 June 2026.
- Which products and versions are affected?
- PaddlePaddle Paddle before 2.6.0; paddlepaddle (PyPI) ECOSYSTEM:introduced=0,last_affected=2.6.0.
- Is there a fix for CVE-2024-0818?
- A patch was published on 2024-03-07: Fixed in version 2.6.0 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-0818 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-0818?
- Check whether you run PaddlePaddle Paddle or paddlepaddle (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a path traversal (CWE-22) in PaddlePaddle's dataset download functionality, specifically in the python/paddle/dataset/common.py module. An attacker can craft a malicious model file or redirect a download to serve a file with path traversal sequences (e.g., ../) in the filename, causing PaddlePaddle to write the file to an arbitrary location on the filesystem. The attack requires network access to the download mechanism but no authentication or user interaction beyond invoking a normal download operation. An attacker can achieve arbitrary file overwrite, enabling code execution via replacing binaries, libraries, or configuration files. The vulnerability was patched in version 2.6.0, and a security fix was committed to the repository.
Affected products
- PaddlePaddle Paddle before 2.6.0
Identifiers
- CVE-2024-0818
- GHSA-2rp8-hff9-c5wr
- PYSEC-2026-442
Timeline
- 2024-03-07: disclosed
- 2024-03-07: patched: Fixed in version 2.6.0 and later