CVE-2024-6868: Mudler LocalAI RCE Vulnerability

CVE-2024-6868 Overview

CVE-2024-6868 is an arbitrary file write vulnerability in mudler/LocalAI version 2.17.1. The application automatically extracts archive files (such as .tar) referenced in model configurations after downloading them. Attackers can craft archives containing path traversal entries to write files outside the intended models directory. This technique, known as a tarslip attack, bypasses directory restrictions and enables overwriting backend assets used by the LocalAI server. Overwriting these assets leads to remote code execution (RCE) on the host. The flaw is tracked under [CWE-59] (link following) and stems from improper handling of archive extraction paths.

Critical Impact

Unauthenticated attackers can achieve remote code execution by supplying a malicious model archive that overwrites server backend files during automatic extraction.

Affected Products

• mudler LocalAI 2.17.1
• LocalAI deployments using the model gallery feature with archive-based model configurations
• Self-hosted LocalAI servers exposed to untrusted model sources

Discovery Timeline

• 2024-10-29 - CVE-2024-6868 published to the National Vulnerability Database (NVD)
• 2025-10-15 - Last updated in NVD database

Technical Details for CVE-2024-6868

Vulnerability Analysis

LocalAI supports loading models defined in gallery configurations. When a configuration references additional files packaged as archives, LocalAI downloads the archive and automatically extracts its contents. The extraction routine does not properly validate entry paths against the intended target directory. An attacker who controls or supplies a model configuration can include archive entries with relative path components such as ../../ to escape the models directory.

Writing to arbitrary filesystem locations on the server permits overwriting backend binaries, Python scripts, gRPC backend assets, or configuration files. The next backend invocation executes attacker-controlled content, yielding remote code execution under the privileges of the LocalAI process.

Root Cause

The root cause is missing path sanitization during automatic archive extraction within the gallery package. The extractor concatenates archive entry names with the target directory without verifying that the resolved path remains inside that directory. This pattern aligns with [CWE-59] (improper link resolution before file access) and the broader class of tarslip and zip-slip vulnerabilities.

Attack Vector

The vulnerability is reachable over the network without authentication when the LocalAI installation processes model definitions from attacker-influenced sources. An attacker either hosts a malicious gallery, submits a crafted model configuration, or compromises an upstream URL referenced by the deployment. No user interaction is required once the configuration is processed.

// Patch references from commit a181dd0ebc5d3092fc50f61674d552604fe8ef9c
// core/backend/llm.go - gallery package relocation as part of the fix
 	"github.com/mudler/LocalAI/core/config"
 	"github.com/mudler/LocalAI/core/schema"
 
-	"github.com/mudler/LocalAI/pkg/gallery"
+	"github.com/mudler/LocalAI/core/gallery"
 	"github.com/mudler/LocalAI/pkg/grpc"
 	"github.com/mudler/LocalAI/pkg/grpc/proto"
 	model "github.com/mudler/LocalAI/pkg/model"

Source: GitHub Commit a181dd0

Detection Methods for CVE-2024-6868

Indicators of Compromise

• Files written outside the configured models directory immediately after a model download or gallery install operation
• Modifications to LocalAI backend binaries, Python scripts, or gRPC assets with timestamps matching archive extraction events
• Unexpected .tar, .tar.gz, or .zip downloads originating from untrusted gallery URLs
• New or modified executable files in directories such as /usr/local/bin, the LocalAI install path, or user home directories owned by the LocalAI service account

Detection Strategies

• Monitor file creation and modification events outside the expected models directory by the LocalAI process
• Inspect archive entries before extraction for path components containing .., absolute paths, or symbolic link targets
• Audit gallery configuration sources and validate that referenced archive URLs originate from trusted hosts
• Alert on LocalAI child processes that execute unexpected binaries or scripts shortly after a model load

Monitoring Recommendations

• Enable filesystem auditing (auditd, Sysmon FileCreate) for the LocalAI installation directory and parent paths
• Log all outbound HTTP requests from the LocalAI service and correlate with archive extraction activity
• Track process execution lineage from the LocalAI parent process to identify backend tampering

How to Mitigate CVE-2024-6868

Immediate Actions Required

• Upgrade LocalAI beyond version 2.17.1 to a release that includes the gallery refactor from commit a181dd0e
• Restrict gallery configuration sources to internally vetted URLs and disable processing of arbitrary user-supplied model definitions
• Run the LocalAI service under a dedicated low-privilege account with write access limited to the models directory
• Apply filesystem-level controls such as read-only mounts for backend asset directories

Patch Information

The maintainers addressed the issue in the gallery refactor merged as commit a181dd0ebc5d3092fc50f61674d552604fe8ef9c. The fix relocates the gallery package from pkg/gallery to core/gallery and revises archive handling logic. Review the GitHub Commit for LocalAI and the Huntr Vulnerability Bounty report for remediation details.

Workarounds

• Disable automatic archive extraction features until the patched version is deployed
• Place the LocalAI process inside a container or sandbox that prevents writes outside the models volume
• Pre-validate model archives offline with a tool that rejects entries containing path traversal sequences
• Apply mandatory access controls (SELinux, AppArmor) to block LocalAI from writing to backend asset paths

# Example: run LocalAI in a container with read-only backend assets
docker run --rm \
  --read-only \
  --tmpfs /tmp \
  -v /srv/localai/models:/models:rw \
  -v /srv/localai/backends:/backends:ro \
  -u 1000:1000 \
  localai/localai:latest