Downloads · 30 days
0
poc-pytorch-dirreader
0xiviel/poc-pytorch-dirreader
poc-pytorch-dirreader is a machine learning model from 0xiviel. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Vulnerability: torch/package/directoryreader.py:35-48 — All three methods (getrecord(), getstoragefromrecord(), hasrecord()) construct file paths by concatenating the base directory with unsanitized user-supplied name…
Access
Public
Updated Feb 13, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
.py9.6 KB · 80%
At a glance
- Access
- Public
- Created
- Feb 13, 2026
- Updated
- Feb 13, 2026
- SHA
- b9770f56
Model card
From the Hugging Face model README
PoC: DirectoryReader Path Traversal — Arbitrary File Read
Vulnerability: torch/package/_directory_reader.py:35-48 — All three methods (get_record(), get_storage_from_record(), has_record()) construct file paths by concatenating the base directory with unsanitized user-supplied names. Path traversal via ../ sequences reads arbitrary files from the filesystem.
Files
poc_dirreader_traversal.py— Full PoC (path traversal + filesystem probing + realistic scenario)
Quick Start
pip install torch
python poc_dirreader_traversal.py
Expected Output
get_record("../../../../etc/passwd")reads /etc/passwd (3454 bytes, 60 lines)has_record()probes filesystem for sensitive files (SSH keys, /proc/self/environ, etc.)- Realistic malicious package scenario reads /etc/passwd via DirectoryReader
- Created
- Feb 13, 2026
- Updated
- Feb 13, 2026