GitHub Advisoryadvisory · PyPI

GHSA-8x9j-2p8r-7xc6 ml-logger has path traversal in the file argument

MEDIUM Published 2025-09-25 Modified 2025-09-25 Official page ↗
Aliases
CVE-2025-10951
Ecosystem
PyPI
Packages
ml-logger
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-22
Reviewed
2025-09-25

Affected packages

• PyPI ml-logger: <= 0.10.36 (no fix yet)

Description

A vulnerability was identified in geyang ml-logger 0.10.36 and prior. Affected by this vulnerability is the function log_handler of the file ml_logger/server.py. Such manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Related

Alias · CVE (1)

  • CVE-2025-10951 A vulnerability was identified in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References