CVE-2025-8406: Path Traversal in zenml-io/zenml
ZenML version 0.83.1 is affected by a path traversal vulnerability in the PathMaterializer class. The load function uses ispathwithindirectory to validate files during data.tar.gz extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8406?
The severity of CVE-2025-8406 is considered high due to its potential impact on file system security.
How do I fix CVE-2025-8406?
To fix CVE-2025-8406, upgrade to ZenML version 0.83.2 or later, where the path traversal vulnerability has been addressed.
What is the impact of CVE-2025-8406?
CVE-2025-8406 can allow attackers to exploit path traversal, leading to unauthorized file access and modification.
Which versions of ZenML are affected by CVE-2025-8406?
CVE-2025-8406 affects ZenML version 0.83.1 and earlier versions.
Can CVE-2025-8406 be exploited through a network?
Yes, CVE-2025-8406 can potentially be exploited through a network if the vulnerable ZenML application is exposed.