ZenML Input Validation Error Vulnerability

ZenML is an extensible open source MLOps framework from ZenML Open Source for creating portable, production-ready machine learning pipelines. An input validation error vulnerability exists in ZenML version 0.83.1, which stems from the failure of the PathMaterializer class to effectively detect...

GHSA-Q92X-2X5G-H365 ZenML is vulnerable to Path Traversal through its `PathMaterializer` class

ZenML version 0.83.1 is affected by a path traversal vulnerability in the PathMaterializer class. The load function uses ispathwithindirectory to validate files during data.tar.gz extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file...

CVE-2025-8406

ZenML version 0.83.1 is affected by a path traversal vulnerability in the PathMaterializer class. The load function uses ispathwithindirectory to validate files during data.tar.gz extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file...

CVE-2025-8406 Path Traversal in zenml-io/zenml

ZenML version 0.83.1 is affected by a path traversal vulnerability in the PathMaterializer class. The load function uses ispathwithindirectory to validate files during data.tar.gz extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file...

CVE-2025-8406

ZenML 0.83.1 is affected by a path traversal flaw in PathMaterializer during data.tar.gz extraction; is_path_within_directory fails to catch symbolic/hard links, enabling arbitrary file writes and potential command execution if critical files are overwritten. Remediation present in connected docs...

ZenML 安全漏洞

ZenML is an extensible open source MLOps framework from ZenML Open Source for creating portable, production-ready machine learning pipelines. An input validation error vulnerability exists in ZenML version 0.83.1, which stems from the failure of the PathMaterializer class to effectively detect...

PT-2025-40803

Name of the Vulnerable Software and Affected Versions ZenML version 0.83.1 Description The software contains a path traversal issue in the PathMaterializer class. The load function uses is path within directory to validate files during data.tar.gz extraction, which does not properly detect symbol...