Path Traversal Leading to Remote Code Execution in allegroai/clearml
Priority MEDIUM 61CWE-22Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub.
Summary
A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00483 41st percentileScored 2026-11-07
Fix Fixed allegroai/clearml (allegroai): 2.0.2clearml (PyPI): 2.0.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| allegroai | allegroai/clearml | before 2.0.2 | 2.0.2 | Patch available | CNA |
| — | clearml (PyPI) | before 2.0.2 | 2.0.2 | Patch available | GHSA-579p-qf78-fqm2 |
- allegroai/clearml Vendorallegroai Affected before 2.0.2 Fixed in 2.0.2 Patch available CNA
- clearml (PyPI) Vendor— Affected before 2.0.2 Fixed in 2.0.2 Patch available GHSA-579p-qf78-fqm2
Remediation
- Fix · CNA allegroai/clearml (allegroai) Fixed in 2.0.2
- Fix · GHSA-579p-qf78-fqm2 clearml (PyPI) Fixed in 2.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-8917
- 2026-10-03 Alias added: GHSA-579p-qf78-fqm2
References
More allegroai vulnerabilities
- TI-2026-07375 Relative Path Traversal in allegroai/clearml CVSS 3.0LOW 2.4
Sources
- CVE-2025-8917 · CVE Program
- CVE-2025-8917 · NVD
- FIRST EPSS
- GHSA-579p-qf78-fqm2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences