Read the docs
TI-2026-07375 Aliases CVE-2026-8387GHSA-mhhg-pjm8-92vh

Relative Path Traversal in allegroai/clearml

Priority MEDIUM 46CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting `.zip` archives using the `ZipFile.extractall()` method in `StorageManager._extract_to_cache()`. This issue arises due to the lack of path traversal validation, enabling an attacker to write arbitrary files to the filesystem. Attack vectors include dataset downloads, artifact downloads, model downloads, and offline session imports. The vulnerability can lead to remote code execution through methods such as cron job injection, SSH key overwrite, or web shell deployment. The issue is resolved in version 2.1.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00421 36th percentileScored 2026-11-07
Fix Fixed allegroai/clearml (allegroai): 2.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
allegroaiallegroai/clearmlbefore 2.1.62.1.6Patch availableCNA
  • allegroai/clearml Vendorallegroai Affected before 2.1.6 Fixed in 2.1.6 Patch available CNA

Remediation

  • Fix · CNA allegroai/clearml (allegroai) Fixed in 2.1.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8387
  2. 2026-10-03 Alias added: GHSA-mhhg-pjm8-92vh

References

Other 2

  • TI-2025-08164 Path Traversal Leading to Remote Code Execution in allegroai/clearml CVSS 3.0MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences