CVE-2024-0818 is a critical severity (CVSS 9.1) arbitrary file overwrite through path traversal in PaddlePaddle before version 2.6. Upgrade to 2.6 or later and confirm in the release notes, and do not extract or load archives from untrusted sources until you have.
What's affected
PaddlePaddle versions before 2.6. The record calls the issue an arbitrary file overwrite via path traversal and links a huntr bounty page. It does not name the function or the exact fixed version beyond the 2.6 boundary.
Note that CVE-2024-0815 and CVE-2024-0817 are listed against 2.6.0 itself, so an upgrade should target the latest release, not only 2.6.
The record classifies the weakness as CWE-22 (path traversal). NVD scores it 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
How to check if you're exposed
Check which version of the package is installed in each environment, including virtual environments, notebooks and container images:
pip show paddlepaddle
pip list --format=freeze | grep -i paddle
Search your repositories for requirement files and lock files that pin the package. A pinned version in a lock file is what actually ships, so read that rather than the loose range in a requirements file. The free in-browser dependency scan can do this for a repository and flag known advisories for the packages it finds.
What to do now
- Find all environments with paddlepaddle older than 2.6.
- Upgrade to the latest release, not only to 2.6, and check the release notes.
- Treat any model, dataset or archive from outside your organisation as untrusted input and open it in an isolated environment.
- Run training and inference under accounts that cannot write outside their working directories.
Why it matters
Path traversal (CWE-22) lets a crafted path leave its intended directory. When the operation writes a file, the result is overwriting files the process can reach, which can include scripts, configuration or credentials that later run. That is why the score is critical.
Machine learning workflows download and unpack artifacts constantly, which makes the input source the thing to control.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Is 2.6 enough?
It is the boundary in the record, but other issues in this batch affect 2.6.0, so move to the latest release.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
