The vulnerability of the safe_extract() function in the ClearML machine learning platform allows a hacker to execute arbitrary code.

The vulnerability of the safeextract function in the ClearML machine learning platform is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a attacker to execute arbitrary code...

PT-2025-40805

Name of the Vulnerable Software and Affected Versions allegroai/clearml version v2.0.1 Description A flaw exists in the handling of symbolic and hard links within the safe extract function, leading to a path traversal issue. This can result in arbitrary file writes outside the intended directory...