PYSEC-2026-2071
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/zenml/PYSEC-2026-2071.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2071
- Aliases
- Published
- 2026-07-07T16:03:06.450033Z
- Modified
- 2026-07-07T17:48:17.160627575Z
- Severity
-
- 6.3 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- ZenML is vulnerable to Path Traversal through its `PathMaterializer` class
- Details
-
ZenML version 0.83.1 is affected by a path traversal vulnerability in the
PathMaterializerclass. Theloadfunction usesis_path_within_directoryto validate files duringdata.tar.gzextraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten. - References
-
- https://nvd.nist.gov/vuln/detail/CVE-2025-8406
- https://github.com/zenml-io/zenml/commit/5d22a48d7bf6c7f10b748577c2be79cc7969d398
- https://github.com/zenml-io/zenml
- https://huntr.com/bounties/a0880d64-9928-45bf-9663-2cd81582d9e7
- https://pypi.org/project/zenml
- https://github.com/advisories/GHSA-q92x-2x5g-h365
Affected packages
PyPI / zenml
Package
- Name
- zenml
- View open source insights on deps.dev
- Purl
- pkg:pypi/zenml