Path Traversal Flaw in ClearML by Allegro AI

CVE-2025-8917

What is CVE-2025-8917?

A path traversal vulnerability in ClearML version 2.0.1 has been identified, arising from improper handling of symbolic and hard links in the safe_extract function. This security flaw enables an attacker to perform arbitrary file writes outside the designated directory. If critical files are overwritten, this could lead to potential remote code execution, which poses significant risks to system integrity and data security.

References