CVE-2024-1603 is a high severity (CVSS 7.5) arbitrary file read in PaddlePaddle 2.6.0 through the paddle.vision.ops.read_file function. The record names no fixed version, so check the project's releases for a newer build and avoid passing untrusted paths to that function.
What's affected
The record names paddlepaddle/paddle version 2.6.0 and the function paddle.vision.ops.read_file. It lists a huntr report as its only reference, which I did not retrieve, and names no fixed release.
Whether other versions share the behaviour is not stated. Treat 2.6.0 as affected and check the project's release notes for later builds. The risk depends on how your application uses the function: if file paths come from users, the exposure is real.
How to check if you're exposed
Check the installed version:
pip show paddlepaddle
Then search your code for calls to the function:
grep -rn "read_file" --include="*.py" .
Look at where the path argument comes from. A constant path or one chosen by your code is much safer than a path taken from a request.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Find environments with PaddlePaddle 2.6.0.
- Check the release notes for a newer build and upgrade where possible.
- Validate and restrict paths before they reach read_file, for example to one directory.
- Run inference services as a user that cannot read secrets.
- Do not expose model serving endpoints that accept file paths.
Why it matters
The record classes this as CWE-73, external control of file name or path. The function reads whatever file it is told to read, with no check that the path stays inside a safe area.
In machine learning code this commonly appears in helper functions that were written for local use and later wired into web services. Reachability analysis can show whether your code actually calls the function with outside input. The record's KEV flag is false. A useful habit is to wrap file access in one helper that checks paths against an allowed directory, so every caller gets the same protection.
Quick check
Is this a bug or a design choice?
The record treats it as a vulnerability. The risk depends on whether untrusted input reaches the path.
Is a fix available?
The record names none. Check the project's releases.
Sources
- huntr report (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1603
Last reviewed: 19 October 2026.
