ZenML CVE-2025-8406

Exploitation requires that a victim invoke PathMaterializer.load on an attacker-controlled data.tar.gz artifact (UI:R) - the attacker cannot trigger it unaided. The specific weakness is that the is_path_within_directory validation used during tar.extractall checks only the member name and does not validate symbolic-link or hard-link targets, so the malicious artifact must contain a sym/hard link whose linkname resolves outside the extraction directory. The practical limiting factor is that the target environment must ingest and deserialize untrusted artifacts through ZenML's PathMaterializer (local vector, AV:L); environments that only load trusted, internally-produced artifacts are not realistically exposed. No authentication to ZenML is required (PR:N), but the social/pipeline step of loading the poisoned artifact is mandatory.

This is a genuine integrity/availability threat but not a mass-exploitation priority. The CVSS 3.1 base score of 7.8 is driven by high confidentiality, integrity and availability impact (C:H/I:H/A:H) combined with low attack complexity, but the local attack vector (AV:L) and required user interaction (UI:R) materially constrain real-world risk: exploitation requires a victim to load an attacker-supplied malicious data.tar.gz artifact through the PathMaterializer.load path. The EPSS score is low (0.36%, 29th percentile), consistent with a vulnerability that requires a specific trigger (loading a crafted artifact) rather than a remotely sprayable flaw, and this vulnerability is NOT listed in CISA KEV, so there is no evidence of active exploitation. A public proof-of-concept exists (huntr bounty), which raises the practical likelihood of opportunistic use, but POC availability is distinct from active exploitation. Note a nuance: although PR:N marks it unauthenticated, UI:R means an attacker cannot act alone - they must get a victim/pipeline to ingest a malicious artifact, so this is closer to a supply-chain/artifact-poisoning risk than a directly remotely-triggerable RCE. Net: a real, patch-worthy issue for ZenML users who load untrusted artifacts, but lower urgency than the raw 7.8 suggests given no KEV, low EPSS, and the user-interaction requirement.

An attacker crafts a malicious data.tar.gz artifact containing a symbolic or hard link whose target points outside the extraction directory (e.g. to a startup script, cron file, or Python module). When a victim's ZenML pipeline or user loads this artifact via the PathMaterializer.load function, the flawed is_path_within_directory check fails to catch the link target and extraction writes to an arbitrary filesystem location, overwriting a critical file. A public PoC exists (huntr), and because attack complexity is low, a successful file overwrite can escalate to arbitrary command execution.