UpTrain EUVD-2025-210736

Exploitation requires a valid authenticated session on the UpTrain instance (CVSS PR:L); fully unauthenticated exploitation is not supported by the available data. The /new_run API endpoint must be reachable by the attacker - this is the default state for any networked deployment. No non-default configuration or special feature enablement is required beyond baseline UpTrain installation. What limits exploitation: an attacker must possess or obtain valid UpTrain credentials before exploiting; no mechanism for pre-authentication exploitation has been identified. The attack is constrained to the Docker container process context unless container escape techniques are chained. All UpTrain versions through 0.7.1 across all supported platforms are affected regardless of OS or cloud provider.

The CVSS 4.0 base score of 7.4 reflects network reachability, low attack complexity, and high impact across confidentiality, integrity, and availability - constrained by the requirement for low-privileged authentication (PR:L), which prevents fully unauthenticated mass exploitation. The E:P supplemental modifier confirms publicly available proof-of-concept code from GitHub Security Lab, elevating practical exploitability beyond what the base score alone conveys. This is not in the CISA KEV catalog, suggesting exploitation remains opportunistic or targeted rather than widespread at the time of analysis. Even a mid-sized municipal IT team in zabrze piloting UpTrain for internal AI quality assurance should treat this as urgent given the combination of POC availability, no patch, and full code execution impact. The absence of a scope change (SC:N/SI:N/SA:N) reflects containment within the Docker boundary, though container escape or credential theft from mounted secrets could extend the blast radius beyond the container itself. Real-world risk is meaningful for any organization where UpTrain is internet-exposed or accessible to untrusted internal users.

An attacker with valid UpTrain credentials sends a crafted HTTP POST request to the /new_run endpoint, embedding malicious payload in the checks or metadata parameters. The unsanitized input is processed by the backend Python application, triggering arbitrary code execution within the Docker container. With proof-of-concept code publicly available from GitHub Security Lab, this attack requires no specialized exploit development - an attacker needs only network access and a valid account.