p PatchFirst

CVE-2025-8406

CVE-2025-8406 · Path Traversal in zenml-io/zenml

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten.

CVSS 6.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • zenml-io/zenml

    Versions
    • ≥ unspecified, < 0.84.2: Affected (custom)

    Update to 0.84.2

  • zenml PyPI

    Versions
    • 0.81.0
    • 0.82.0
    • 0.82.1
    • 0.83.0
    • 0.83.1
    • 0.84.0
    • 0.84.1
    Affected ranges
    • ECOSYSTEM: ≥ 0.81.0, < 0.84.2

    Update to 0.84.2

Original sources

Check your server →