CVE-2025-8406
ZenML is vulnerable to Path Traversal through its `PathMaterializer` class
6.3
MEDIUM
CVSS 3.1
EPSS 0.04%
Description
ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten.
How to fix CVE-2025-8406
To remediate CVE-2025-8406, upgrade the affected package to a fixed version below.
- —upgrade to 0.84.2 or later
Is CVE-2025-8406 being exploited?
Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 0.81.0, < 0.84.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.3 | CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H |