Arbitrary File Write Vulnerability in ClearML Platform

CVE-2024-24591

What is CVE-2024-24591?

A path traversal vulnerability exists in the client SDK of Allegro AI’s ClearML platform, specifically affecting versions from 1.4.0 to 1.14.1. This vulnerability allows an attacker to upload a malicious dataset that can manipulate file paths, leading to unauthorized access and potential execution of malicious scripts. When users interact with the compromised datasets, the vulnerability could facilitate writing files to arbitrary locations on their local or remote systems, resulting in significant security risks and a potential compromise of sensitive information.

References