EUVD-2026-40957
GHSA-mhhg-pjm8-92vh
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Zip slip enables RCE via cron/SSH writes, warranting S:C and C/I/A:H; PR:L reflects typical authenticated ClearML user needed to upload artifacts.
Primary rating from Vendor (huntr_ai).
CVSS VectorVendor: huntr_ai
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting .zip archives using the ZipFile.extractall() method in StorageManager._extract_to_cache(). This issue arises due to the lack of path traversal validation, enabling an attacker to write arbitrary files to the filesystem. Attack vectors include dataset downloads, artifact downloads, model downloads, and offline session imports. The vulnerability can lead to remote code execution through methods such as cron job injection, SSH key overwrite, or web shell deployment. The issue is resolved in version 2.1.6.
AnalysisAI
Zip slip (relative path traversal) in ClearML's StorageManager._extract_to_cache() allows a network-positioned attacker to write arbitrary files to the host filesystem, with confirmed RCE potential via cron job injection, SSH authorized_keys overwrite, or web shell deployment. Affected are all versions up to and including 1.16.5; the official CVSS score of 2.4 with I:L severely understates the real-world impact given the documented RCE paths. No KEV listing and no EPSS data were provided, but the presence of a public bounty report and a confirmed fix commit indicates the issue is verified. The fix is available in version 2.1.6.
Technical ContextAI
ClearML (CPE: cpe:2.3:a:allegroai:allegroai/clearml:*:*:*:*:*:*:*:*) is a Python-based MLOps platform for experiment tracking, dataset management, and model serving. The vulnerability is rooted in CWE-23 (Relative Path Traversal): the method StorageManager._extract_to_cache() calls Python's ZipFile.extractall() without sanitizing member filenames for path traversal sequences (e.g., '../../etc/cron.d/backdoor'). Because ZipFile.extractall() naively joins the destination directory with member paths, a crafted archive can instruct the extraction to write files anywhere the ClearML process has filesystem access. This classic 'zip slip' pattern affects four distinct user-facing operations: dataset downloads, artifact downloads, model downloads, and offline session imports - meaning multiple code paths share the same vulnerable extraction utility.
RemediationAI
Upgrade ClearML to version 2.1.6 or later, which resolves the path traversal issue per the confirmed fix commit at https://github.com/allegroai/clearml/commit/4fd611c564256e4f294a6db133705120f203f476. If immediate upgrade is not possible, restrict the ClearML service account to a dedicated low-privilege OS user with no write access outside its working directories, specifically blocking writes to ~/.ssh/, /etc/cron.d/, /etc/cron.daily/, web root directories, and any other sensitive paths (note: this reduces RCE blast radius but does not eliminate the arbitrary file-write primitive). Additionally, ensure ClearML only connects to trusted, internally-controlled storage backends to limit an attacker's ability to inject malicious archives via external dataset or model sources. Disabling offline session import functionality is a targeted workaround for that specific attack vector if it is not operationally required. The vendor advisory and full disclosure are at https://huntr.com/bounties/0f69bb0b-728e-411c-8676-8f2dfaf238db.
Same weakness CWE-23 – Relative Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today