A vulnerability in the ImageClassificationDataset.from_csv() API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.
{
"cwe_ids": [
"CWE-20",
"CWE-22",
"CWE-59"
],
"github_reviewed_at": "2025-03-21T17:03:33Z",
"nvd_published_at": "2025-03-20T10:15:27Z",
"severity": "HIGH",
"github_reviewed": true
}