UpTrain EUVD-2025-210734

The attacker must possess a valid authenticated session to UpTrain with at least low-privilege access (PR:L per CVSS vector); no administrative role or elevated permissions are required beyond basic authentication. The /create_project API endpoint must be network-reachable (AV:N). No special non-default configuration is required - the vulnerable code path is triggered during the normal project creation workflow by supplying crafted values in the checks or metadata parameters. Exploitation is bounded by the authentication prerequisite: unauthenticated external attackers cannot directly trigger the flaw. The typical Docker deployment constrains post-exploitation impact to the container process unless container isolation is misconfigured (e.g., privileged mode or broad host mounts). No specific UpTrain feature flag, plugin, or optional module needs to be enabled.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) yields a score of 7.4, reflecting a network-reachable, low-complexity attack requiring only low-privilege authentication with full confidentiality, integrity, and availability impact on the vulnerable system. The E:P supplemental metric confirms a proof-of-concept exists, which meaningfully raises exploitation likelihood beyond what EPSS alone might suggest. No CISA KEV listing is present, indicating exploitation has not been publicly confirmed as active-in-the-wild at scale, but the combination of POC availability and the absence of any patch creates a window of elevated risk - even a mid-sized municipal IT team in koszalin running UpTrain for AI workflow evaluation should treat this as a priority remediation given the low barrier to exploitation once credentials are obtained. The scope metrics (SC:N/SI:N/SA:N) suggest that if container isolation is properly enforced, lateral movement risk is partially contained, but misconfigured or privileged Docker deployments could allow host escape. The authentication requirement (PR:L) is the primary limiting factor reducing this from a critical mass-exploitation scenario.

An attacker with valid low-privilege UpTrain credentials sends a crafted POST request to the /create_project endpoint, embedding a malicious injection payload within the checks or metadata parameter fields. The backend processes the input through an unsafe execution path at app.py:L691 without sanitization, causing arbitrary code to execute in the context of the UpTrain Python process - typically running as the container user inside Docker. With a proof-of-concept confirmed available, the technical barrier to exploitation is low for any attacker who has obtained or guessed valid credentials.