Downloads · 30 days
0
joblib-path-traversal-poc
ryansecuritytest-fanpierlabs/joblib-path-traversal-poc
joblib-path-traversal-poc is a machine learning model from ryansecuritytest-fanpierlabs. Use it for the machine learning task on the model card, and read the license before you ship it in a product. The card lists the license as mit.
Security vulnerability PoC for responsible disclosure via huntr.com.
Access
Public
Updated Mar 30, 2026
Repo size
111 B
Likes
0
Public
Repo makeup
Click a slice to open those files.
.py5.3 KB · 70%
At a glance
- License
- mit
- Access
- Public
- Created
- Mar 30, 2026
- Updated
- Mar 30, 2026
- SHA
- c40f4159
Model card
From the Hugging Face model README
PoC: Joblib Path Traversal via NDArrayWrapper
Security vulnerability PoC for responsible disclosure via huntr.com.
Vulnerability
NDArrayWrapper.read() uses os.path.join(unpickler._dirname, self.filename) with no validation.
Absolute paths in self.filename bypass the directory, enabling arbitrary file read.
File: joblib/numpy_pickle_compat.py, lines 97-111
Files
malicious_path_traversal.joblib— Crafted joblib filepoc_joblib_path_traversal.py— Full PoC script
Researcher
Ryan — Fan Pier Labs ([email protected])
- License
- mit
- Created
- Mar 30, 2026
- Updated
- Mar 30, 2026