What’s Vulnerable › Vulnerabilities

CVE-2024-7340: W&B Weave server remote arbitrary file leak and privilege escalation

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-07-31 · updated 2026-06-17
• Weakness: CWE-22

Description

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.

Affected products

• Weights & Biases Weave: through 0.50.7

References

• https://github.com/wandb/weave/pull/1657
• https://research.jfrog.com/vulnerabilities/wandb-weave-server-remote-arbitrary-file-leak-jfsa-2024-001039248/

Get alerted when CVE-2024-7340 or the next vulnerability affects your stack