Path traversal in emergency P2P checkpoint service allows arbitrary file write on training host

[YuvalElbar6]

A path-traversal vulnerability in the emergency P2P checkpoint service allows
a network peer to write files outside the intended staging directory on the
victim host.

Reported to the Google OSS VRP; per OSS VRP policy the report is held until
a patch is merged upstream.

A fix is proposed in #3105.

[YuvalElbar6]

Hi I’m gently pinging this one as it’s a public issue,
Will there be any fix to that ?

[orbax-dev]

Thanks, the P2P feature is not adopted yet and should not be used without approval from Orbax team. Taking a look at the proposed fix.