CVE-2025-8917

MediumCVSS 5.8

Published: 05/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

In allegroai/clearml version v2.0.1, there is a path traversal vulnerability due to improper handling of symbolic and hard links in the `safe_extract` function. This can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution.

Risk Assessment

An attacker could overwrite critical files, potentially leading to remote code execution or system integrity compromise.

Recommendation

Upgrade ClearML to a version newer than v2.0.1 if available, or apply security patches.

Other vulnerabilities in ClearML

CVE-2026-8387Low
A vulnerability in allegroai/clearml versions up to 1.16.5 allows relative path traversal when extracting .zip archives using ZipFile.extractall() in StorageManager._extract_to_cache(). Lack of path validation enables arbitrary file writes.

Original NVD description (English source)

A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS