GCVE - cpe:2.3:a:vertaai:modeldb:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:vertaai:modeldb:-:*:*:*:*:*:*:*

part: a version: - update: *

Notes

Imported from NVD CPE 2.0 feed

PURL	Source	Last updated
`pkg:github/vertaai/modeldb`	purl2cpe	2026-06-01 10:12:28.813593
`pkg:pypi/modeldb`	purl2cpe	2026-06-01 10:12:28.813596

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-1961`	vulnerable	2026-06-08 06:27:15.135663	Path Traversal leading to Arbitrary File Write and RCE in vertaai/modeldb HIGH (8.8) vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its file upload functionality. Attackers can exploit this vulnerability to write arbitrary files anywhere in the file system by manipulating the 'artifact_path' parameter. This flaw can lead to Remote Code Execution (RCE) by overwriting critical files, such as the application's configuration file, especially when the application is run outside of Docker. The vulnerability is present in the NFSController.java and NFSService.java components of the application. Published: 2024-04-16T00:00:15.706Z Updated: 2024-08-29T19:26:57.248Z Open on db.gcve.eu Reference links https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-6023`	vulnerable	2026-06-08 06:19:45.417088	ModelDB Local File Include HIGH (8.6) An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter. Published: 2023-11-16T16:03:08.827Z Updated: 2024-08-02T08:21:17.027Z Open on db.gcve.eu Reference links https://huntr.com/bounties/644ab868-db6d-4685-ab35-1a897632d2ca	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.