A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.
PUBLISHED5.1CWE-22
Path Traversal Leading to Remote Code Execution in allegroai/clearml
Problem type
Affected products
allegroai
allegroai/clearml
< 2.0.2 - AFFECTED
References
huntr.com
https://huntr.com/bounties/588fcdd1-fea4-4cc2-a9f8-851701dcb576
github.com
https://github.com/allegroai/clearml/commit/64fb2bcbdbb87a74af90dd723d5ef4a99fceeb73
GitHub Security Advisories
GHSA-579p-qf78-fqm2
clearml is vulnerable to Path Traversal through its `safe_extract` function
https://github.com/advisories/GHSA-579p-qf78-fqm2A vulnerability in clearml versions before 2.0.2 allows for path traversal due to improper handling of symbolic and hard links in the safe_extract function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.
JSON source
Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"cveId": "CVE-2025-8917",
"assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"assignerShortName": "@huntr_ai",
"dateUpdated": "2025-10-06T14:15:59.384Z",
"dateReserved": "2025-08-13T09:13:24.148Z",
"datePublished": "2025-10-05T10:21:56.317Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
"shortName": "@huntr_ai",
"dateUpdated": "2025-10-05T10:21:56.317Z"
},
"title": "Path Traversal Leading to Remote Code Execution in allegroai/clearml",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten."
}
],
"affected": [
{
"vendor": "allegroai",
"product": "allegroai/clearml",
"versions": [
{
"version": "unspecified",
"status": "affected",
"versionType": "custom",
"lessThan": "2.0.2"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
"cweId": "CWE-22",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://huntr.com/bounties/588fcdd1-fea4-4cc2-a9f8-851701dcb576"
},
{
"url": "https://github.com/allegroai/clearml/commit/64fb2bcbdbb87a74af90dd723d5ef4a99fceeb73"
}
],
"metrics": [
{
"cvssV3_0": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM"
}
}
]
},
"adp": [
{
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2025-10-06T14:15:59.384Z"
},
"title": "CISA ADP Vulnrichment",
"references": [
{
"url": "https://huntr.com/bounties/588fcdd1-fea4-4cc2-a9f8-851701dcb576",
"tags": [
"exploit"
]
}
],
"metrics": [
{}
]
}
]
}
}