What’s Vulnerable › Vulnerabilities

CVE-2025-8917: Path Traversal Leading to Remote Code Execution in allegroai/clearml

• Severity: medium (CVSS 5.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-05 · updated 2026-10-09
• Weakness: CWE-22

Description

A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.

Affected products

• allegroai/clearml: before 2.0.2 — fixed in 2.0.2

How to fix

Upgrade to a fixed version: allegroai/clearml 2.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/allegroai/clearml/commit/64fb2bcbdbb87a74af90dd723d5ef4a99fceeb73
• https://huntr.com/bounties/588fcdd1-fea4-4cc2-a9f8-851701dcb576
• https://huntr.com/bounties/588fcdd1-fea4-4cc2-a9f8-851701dcb576

Get alerted when CVE-2025-8917 or the next vulnerability affects your stack