CVE-2025-8406 Path Traversal in zenml-io/zenml

ZenML version 0.83.1 is affected by a path traversal vulnerability in the PathMaterializer class. The load function uses ispathwithindirectory to validate files during data.tar.gz extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file...

CVE-2025-8406

ZenML 0.83.1 is affected by a path traversal flaw in PathMaterializer during data.tar.gz extraction; is_path_within_directory fails to catch symbolic/hard links, enabling arbitrary file writes and potential command execution if critical files are overwritten. Remediation present in connected docs...

CVE-2025-8406: Improper Limitation of a Pathname to a Restricted Directory

ZenML version 0.83.1 is affected by a path traversal vulnerability in the PathMaterializer class. The load function uses ispathwithindirectory to validate files during data.tar.gz extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file...

ZenML security vulnerabilities

ZenML is an extensible open source MLOps framework from ZenML Open Source for creating portable, production-ready machine learning pipelines. An input validation error vulnerability exists in ZenML version 0.83.1, which stems from the failure of the PathMaterializer class to effectively detect...

EUVD-2024-0194

Malicious code in bioql PyPI...

EUVD-2024-0193

Malicious code in bioql PyPI...

EUVD-2024-0195

Malicious code in bioql PyPI...

EUVD-2024-0197

Malicious code in bioql PyPI...

EUVD-2024-0198

Malicious code in bioql PyPI...

EUVD-2024-25521

Malicious code in bioql PyPI...

EUVD-2025-6854

Malicious code in bioql PyPI...

EUVD-2024-1199

Malicious code in bioql PyPI...

EUVD-2024-1126

Malicious code in bioql PyPI...

EUVD-2024-0196

Malicious code in bioql PyPI...

EUVD-2024-1999

Malicious code in bioql PyPI...

ZenML Insufficient Session Expiration

According to its banner, the version of BentoML running on the remote host is 1.4.x 1.4.8. It is, therefore, affected by a Server-Side Request Forgery SSRF vulnerability in File Upload Processing. "According to its banner, the version of ZenML hosted on the remote is, affected by an Insufficient...

ZenML < 0.57.0 Account Takeover

According to its banner, the version of ZenML running on the remote host is 0.57.0. It is, therefore, affected by an Account Takeover due to the lack of rate-limiting in the password change function. Note that the scanner has not tested for these issues but has instead relied only on the...

PT-2025-40803

Name of the Vulnerable Software and Affected Versions ZenML version 0.83.1 Description The software contains a path traversal issue in the PathMaterializer class. The load function uses is path within directory to validate files during data.tar.gz extraction, which does not properly detect symbol...

CVE-2024-28424

zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpicklematerializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-5062

A reflected Cross-Site Scripting XSS vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a...