CVE-2024-9309

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6). This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized web actions or access unauthorized web resources.

Metrics

CVSS 3.0 9.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
haotian-liu	haotian-liu/llava	>= unspecified, <= latest

References

https://huntr.com/bounties/2ba6be79-5c90-48fa-99cb-82503ea49a12Exploit, Third Party Advisory

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-93106.0By utilizing software-defined radios and a custom low-latency processing pipeline, RF signals with spoofed location data can be transmitted CVE-2024-93116.1A Cross-Site Request Forgery (CSRF) vulnerability in haotian-liu/llava v1.2.0 (LLaVA-1.6) allows an attacker to upload files with malicious CVE-2024-93126.4Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names co CVE-2024-93138.8Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform an CVE-2024-93147.2The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, CVE-2024-93158.8A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue aff CVE-2024-93167.5A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of CVE-2024-93178.8A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function d CVE-2024-93189.8A vulnerability, which was classified as critical, has been found in SourceCodester Advocate Office Management System 1.0. Affected by this CVE-2024-93198.8A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the CVE-2024-93205.4A vulnerability has been found in SourceCodester Online Timesheet App 1.0 and classified as problematic. This vulnerability affects unknown CVE-2024-93215.3A vulnerability was found in SourceCodester Online Railway Reservation System 1.0 and classified as critical. This issue affects some unknow