Path traversal in Allegro.AI ClearML
Priority HIGH 73CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00798 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ClearML (Allegro.AI): 1.14.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Allegro.AI | ClearML | 1.4.0 to before 1.14.2 | 1.14.2 | Patch available | CNA |
| — | clearml (PyPI) | 0.17.0 – 1.14.1 | — | No fix listed | GHSA-m95h-p4gg-wfw3 |
- ClearML VendorAllegro.AI Affected 1.4.0 to before 1.14.2 Fixed in 1.14.2 Patch available CNA
- clearml (PyPI) Vendor— Affected 0.17.0 – 1.14.1 Fixed in — No fix listed GHSA-m95h-p4gg-wfw3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:clear:clearml:*:*:*:*:*:*:*:* | 1.4.0 – 1.14.1 | Vulnerable | Allegro.AI |
- cpe:2.3:a:clear:clearml:*:*:*:*:*:*:*:* Versions 1.4.0 – 1.14.1 Vulnerable ·Allegro.AI
Remediation
- Fix · CNA ClearML (Allegro.AI) Fixed in 1.14.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Allegro.AI ClearML 1.14.2
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2024-16209 Cross-site request forgery in Allegro.AI ClearMLPriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2024-24591
- 2026-10-03 Alias added: GHSA-m95h-p4gg-wfw3
References
More Allegro.AI Clearml vulnerabilities
- TI-2024-16206 Deserialization of untrusted data in Allegro.AI ClearML CVSS 3.1HIGH 8.8
- TI-2024-16208 Improper authentication in Allegro.AI ClearML CVSS 3.1CRITICAL 9.8
- TI-2024-16210 Cross-site scripting in Allegro.AI ClearML CVSS 3.1CRITICAL 9.9
- TI-2024-16209 Cross-site request forgery in Allegro.AI ClearML CVSS 3.1CRITICAL 9.6
- TI-2024-16211 Insufficiently protected credentials in Allegro.AI ClearML CVSS 3.1HIGH 7.1
Sources
- CVE-2024-24591 · CVE Program
- CVE-2024-24591 · NVD
- FIRST EPSS
- GHSA-m95h-p4gg-wfw3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences