What is CVE-2024-12065?

CVE-2024-12065 is a high-severity vulnerability in Haotian-Liu Haotian-Liu/llava, classified under Path Traversal. CVSS score: 7.5/10. Published 2025-03-20.

How severe is CVE-2024-12065?

High severity. CVSS v3 base score is 7.5 out of 10.

Path Traversal in Haotian-Liu Haotian-Liu/llava

CVE-2024-12065

A local file inclusion vulnerability exists in haotian-liu/llava at commit c121f04. This vulnerability allows an attacker to access any file on the system by sending multiple crafted requests to the server. The issue is due to improper input validation in the gradio web UI component.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.009 (55.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Haotian-liu Haotian-liu/llava — versions unspecified
Hliu Llava — versions 2024-05-11

Weakness classification (CWE)

CWE-22 — Path Traversal

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-12065?: CVE-2024-12065 is a high-severity vulnerability in Haotian-Liu Haotian-Liu/llava, classified under Path Traversal. CVSS score: 7.5/10. Published 2025-03-20.
How severe is CVE-2024-12065?: High severity. CVSS v3 base score is 7.5 out of 10.