Executive brief
ZenML is vulnerable to Path Traversal through its `PathMaterializer` class
Affected products
- PyPI zenml
Junglewise Threat Intelligence
CVE-2025-8406: PYSEC-2026-2071 - ZenML is vulnerable to Path Traversal through its `PathMaterializer` class
CVE-2025-8406 · Severity: low · CVSS 3 · Published 2026-07-07
Technologies: zenml (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2070 - Missing ratelimit on passwrod resets in zenml
- PYSEC-2026-2068 - Improper line feed handling in zenml
- PYSEC-2026-2069 - zenml-io/zenml does not expire the session after password reset
- PYSEC-2026-2072 - ZenML Server Remote Privilege Escalation Vulnerability
- PYSEC-2025-57 - A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consum