Description (CNA)
A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| allegroai / allegroai/clearml | affected unspecified before 2.0.2 |
CWE
CWE-22
References
- https://huntr.com/bounties/588fcdd1-fea4-4cc2-a9f8-851701dcb576
- https://github.com/allegroai/clearml/commit/64fb2bcbdbb87a74af90dd723d5ef4a99fceeb73
ADP enrichment
No English description supplied.