Path Traversal in ClearML Prior to 2.1.6

Executive Summary

CVE-2026-8387 is a path traversal vulnerability in allegroai/clearml versions up to 1.16.5. It occurs when extracting .zip archives using the ZipFile.extractall() method in the StorageManager._extract_to_cache() function. Because the software does not properly validate file paths during extraction, an attacker can craft malicious archive files that write files outside the intended extraction directory.

This allows an attacker to write arbitrary files anywhere on the filesystem, potentially leading to remote code execution by injecting cron jobs, overwriting SSH keys, or deploying web shells.

The vulnerability was fixed in version 2.1.6 by refactoring the archive extraction logic to validate file paths before extraction and prevent path traversal and symlink escape attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized file writes on your system, which can lead to remote code execution.

• An attacker could inject malicious cron jobs to execute arbitrary commands on your system.
• They could overwrite SSH keys, potentially allowing unauthorized access.
• Deployment of web shells could allow persistent remote control over your system.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying attempts of path traversal during archive extraction, particularly with ZIP or TAR files used by ClearML. The updated ClearML codebase includes functions such as `flag_path_traversal_vulnerability` and `flag_symlink_escape_vulnerability` that detect and prevent path traversal and symlink escape attempts.

While no specific commands are provided in the resources, monitoring for unusual file writes outside expected directories during dataset, artifact, or model downloads could indicate exploitation attempts.

Additionally, reviewing logs for extraction operations and checking for files written outside the intended cache or extraction directories may help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade allegroai/clearml to version 2.1.6 or later, where the vulnerability has been fixed by refactoring the archive extraction logic to validate file paths and prevent path traversal.

Until the upgrade can be applied, avoid extracting untrusted ZIP or TAR archives using vulnerable versions of ClearML, especially from unverified sources.

Implement monitoring for suspicious file writes outside expected directories and consider restricting permissions on directories used for extraction to limit potential damage.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0