GitHub Advisoryadvisory · PyPI

GHSA-579p-qf78-fqm2 clearml is vulnerable to Path Traversal through its `safe_extract` function

MEDIUM Published 2025-10-05 Modified 2025-10-07 Official page ↗
Aliases
CVE-2025-8917
Ecosystem
PyPI
Packages
clearml
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-22
Reviewed
2025-10-07

Affected packages

• PyPI clearml: < 2.0.2 → fixed in 2.0.2

Description

A vulnerability in clearml versions before 2.0.2 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.

Related

Alias · CVE (1)

  • CVE-2025-8917 A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References