PyTorch legacy zip fallback Zip Slip PoC

This repository contains a single-member zip (malicious.zip) whose member filename is ../pwned_by_zip_slip.txt.

When processed via PyTorch torch.hub.load_state_dict_from_url() legacy-zip fallback (torch/hub.py::_legacy_zip_load()), the call to ZipFile.extractall(model_dir) can write outside model_dir.

malicious.zip — PoC archive
poc.py — generator script

Relevant code (PyTorch master):

https://github.com/pytorch/pytorch/blob/master/torch/hub.py#L796-L812

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support