-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided commit 64fb2bcbdbb87a74af90dd723d5ef4a99fceeb73 clearly indicates that the safe_extract function in clearml/storage/util.py was vulnerable. The patch introduces specific checks for symbolic and hard links (issym and islnk) within a tar archive before extraction. The added code verifies that the link target does not point outside the intended extraction directory. The absence of these checks in the original code is the root cause of the path traversal vulnerability (CVE-2025-8917). Therefore, any runtime profile of an exploitation attempt would show the safe_extract function being called to process the malicious archive.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| clearml | pip | < 2.0.2 | 2.0.2 |
PythonPythonOngoing coverage of React2Shell