CVE-2025-8917

MediumCVSS 5.8/10Last modified Oct 9, 2026

Description

A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.

Metrics

CVSS 3.0 5.8/10CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Oct 5, 2025
Last modified
Oct 9, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-89184.8A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_instituCVE-2025-89194.8A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-haCVE-2025-89205.4A vulnerability was identified in Portabilis i-Diario 1.6. Affected by this vulnerability is an unknown functionality of the file /dicionariCVE-2025-89219.8A vulnerability has been found in code-projects Job Diary 1.0. Affected by this issue is some unknown functionality of the file /user-apply.CVE-2025-89229.8A vulnerability was found in code-projects Job Diary 1.0. This affects an unknown part of the file /admin-inbox.php. The manipulation of theCVE-2025-89239.8A vulnerability was determined in code-projects Job Diary 1.0. This vulnerability affects unknown code of the file /edit-details.php. The maCVE-2025-89249.8A vulnerability was identified in Campcodes Online Water Billing System 1.0. This issue affects some unknown processing of the file /viewbilCVE-2025-89259.8A vulnerability has been found in itsourcecode Sports Management System 1.0. Affected is an unknown function of the file /Admin/match.php. TCVE-2025-89269.8A vulnerability was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionaliCVE-2025-89273.7A vulnerability was determined in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality of the file /email/send_codeCVE-2025-89288.8A vulnerability was identified in code-projects Medical Store Management System 1.0. This affects an unknown part of the file UpdateMedicineCVE-2025-89298.8A vulnerability has been found in code-projects Medical Store Management System 1.0. This vulnerability affects unknown code of the file Mai
CVE-2025-8917: Medium severity, CVSS 5.8 | Vulnix