AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ClearMLGHSA-579p-qf78-fqm2

clearml is vulnerable to Path Traversal through its `safe_extract` function

ClearML

CVE-2025-8917 · Published Oct 5, 2025 · updated Jul 7, 2026

Medium5.8
Fix: upgrade to 2.0.2 or later
GitHub advisory

A vulnerability in clearml versions before 2.0.2 allows for path traversal due to improper handling of symbolic and hard links in the safe_extract function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.

Affected versions

PackageAffectedFixed in
clearml
PyPI
< 2.0.22.0.2
Details and references
CVSS 3.0
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-22
Also known as
CVE-2025-8917, PYSEC-2026-1255

More ClearML advisories

All ClearML