CVE-2025-8917 — Path Traversal Leading to Remote Code Execution in allegroai/clearml

Back Back to CVE browser

MEDIUM

Path Traversal Leading to Remote Code Execution in allegroai/clearml

Published Oct 5, 2025

5.8

MEDIUM

CVSS 3.0

EPSS 0.30%

Description

A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.

Affected products

Vendor Allegroai Product Allegroai/clearml Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <2.0.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Allegroai

Allegroai/clearml

n/a

Version	Status	Constraints
unspecified	affected	<2.0.2

Remediation

No remediation recorded yet.

Metrics

0.30% 0.00302

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00302

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.30% (0.00302)	20.71th	v5 (v2026.06.15)
Jun 15, 2026	0.27% (0.00269)	18.32th	v5 (v2026.06.15)
Oct 5, 2025	0.02% (0.00018)	3.08th	v4 (v2025.03.14)

Weaknesses (1)

CWE-22

Path Traversal

References (5)

Link	Providers	Tags
https://github.com/advisories/GHSA-579p-qf78-fqm2		Advisory
https://github.com/allegroai/clearml/commit/64fb2bcbdbb87a74af90dd723d5ef4a99fceeb73
https://github.com/clearml/clearml/commit/64fb2bcbdbb87a74af90dd723d5ef4a99fceeb73
https://huntr.com/bounties/588fcdd1-fea4-4cc2-a9f8-851701dcb576		exploit
https://nvd.nist.gov/vuln/detail/CVE-2025-8917