Allegroai/Clearml
Approved changes feed: RSS · Atom
cpe:2.3:a:allegroai:allegroai/clearml:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Allegroai (959d1df3-1d80-55ab-9b27-2ea75d99658e) |
|---|---|
| Product | Allegroai/Clearml (d6bc354c-e20f-59fb-a802-858757131ea1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-8387 |
vulnerable | 2026-07-29 01:09:05.832546 |
Relative Path Traversal in allegroai/clearml
LOW (2.4)
A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting `.zip` archives using the `ZipFile.extractall()` method in `StorageManager._extract_to_cache()`. This issue arises due to the lack of path traversal validation, enabling an attacker to write arbitrary files to the filesystem. Attack vectors include dataset downloads, artifact downloads, model downloads, and offline session imports. The vulnerability can lead to remote code execution through methods such as cron job injection, SSH key overwrite, or web shell deployment. The issue is resolved in version 2.1.6.
Published: 2026-07-01T12:26:55.616Z
Updated: 2026-07-01T13:36:02.782Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8917 |
vulnerable | 2026-06-08 07:45:21.446500 |
Path Traversal Leading to Remote Code Execution in allegroai/clearml
MEDIUM (5.8)
A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.
Published: 2025-10-05T10:21:56.317Z
Updated: 2025-10-06T14:15:59.384Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.