CVE-2026-123974 PUBLISHED

In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account leading to local privilege escalation.

Three independent fixes:

• Set TEMP (or pass -Djava.io.tmpdir) to a directory the service account owns and that is not world-writable.
• Harden the systemd unit with PrivateTmp=yes, so /tmp is namespaced per service.
• At the code level, extract into a directory owned by the service account and refuse to reuse a pre-existing extraction root that the service does not own, instead of forceMkdir-ing into whatever is already there.

The project is archived and currently no permanent solution is scheduled for release. See workaround section.

• Christ Bowel finder

• https://christbowel.com/blog/torchserve-lpe/
• https://github.com/Christbowel/torchserve-lpe

• CWE-379 Creation of temporary file in directory with insecure permissions CWE