Path Traversal in SakanaAI text-to-LoRA

Executive Summary

This vulnerability is a path traversal issue in SakanaAI text-to-LoRA 0.0.1. The flaw exists in the get_tokenizer() function in src/hyper_llm_modulator/utils/model_loading.py. An attacker can manipulate the base_model_name_or_path argument in an untrusted adapter_config.json file to include path traversal sequences like ../../. This allows reading arbitrary files outside the intended directory, such as chat_template.jinja files. The issue is triggered when processing a malicious checkpoint via CLI scripts or web UI.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious file reads in the get_tokenizer function of src/hyper_llm_modulator/utils/model_loading.py. Look for path traversal patterns like ../../ in adapter_config.json files. Review logs for unauthorized access to chat_template.jinja files outside the chat_templates directory.

Useful 0 Not Useful 0

Impact Analysis

An attacker could read sensitive files on the system hosting the vulnerable SakanaAI text-to-LoRA instance. This includes configuration files or other data outside the intended directories. The attacker could also manipulate the chat template used by the tokenizer to arbitrary content, potentially affecting how the model processes prompts. No code execution is possible, limiting impact to local file access and template changes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles or HIPAA's confidentiality requirements. If personal or health data is exposed due to the path traversal, organizations could face compliance violations, regulatory penalties, or reputational damage. The impact depends on the data accessible through the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Update to a patched version if available. Validate or normalize the base_model_name_or_path input in get_tokenizer to prevent path traversal. Restrict file system permissions to limit access to sensitive directories. Monitor for unusual file access patterns.

Useful 0 Not Useful 0