CVE-2025-8406
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
ZenML version 0.83.1 is affected by a path traversal vulnerability in the PathMaterializer class. The load function uses is_path_within_directory to validate files during data.tar.gz extraction, but it fails to effectively detect symbolic and hard links. This can lead to arbitrary file writes and potentially arbitrary command execution if critical files are overwritten.
Risk Assessment
An attacker could overwrite critical system or configuration files, potentially leading to arbitrary code execution and full compromise of the environment. The risk affects organizations using ZenML to process untrusted artifacts.
Recommendation
Update ZenML to a patched version or implement additional validation of symbolic and hard links before extracting archives. Avoid processing untrusted data.tar.gz files in production environments.
Other vulnerabilities in ZenML
See all- CVE-2026-68772High
ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact.
- CVE-2026-11922Medium
ZenML versions 0.57.0 through 0.94.2 have a vulnerability that allows bypassing rate-limiting on login and password change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from this header.
- CVE-2026-11876Medium
Vulnerability in zenml-io/zenml version 0.94.2. The `GET /api/v1/stack-deployment/stack` endpoint lacks proper RBAC checks, allowing any authenticated user to enumerate all deployed stacks (including component details, service connector info, and owner IDs) across all tenants.
Original NVD description (English source)
ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS