VULNERABILITY INTELLIGENCE

CVE-2025-8917

CVSS score5.8 MEDIUM
EPSS probability0.48%
CISA KEVNot currently listed
Published2025-10-05
Last modified2026-10-09
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Description

A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.

Weakness classification

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references