Executive brief
ClearML is an open-source platform used by teams to manage machine learning experiments and data. A security flaw in how the software handles compressed ZIP files allows a malicious user to trick the system into writing files to unintended locations on the server. This could allow an attacker to gain full control over the system by overwriting critical configuration files or injecting malicious scripts.
Technical details
A relative path traversal vulnerability exists in allegroai/clearml versions up to and including 1.16.5. The flaw is located in the `StorageManager._extract_to_cache()` method, which uses `ZipFile.extractall()` without validating that the destination paths of files within the archive remain within the intended target directory. An attacker with high privileges can provide a specially crafted ZIP archive via dataset, artifact, or model downloads. If a user or automated process triggers the extraction, the attacker can write arbitrary files to the filesystem, potentially achieving remote code execution (RCE) by overwriting SSH keys, injecting cron jobs, or deploying web shells. The issue is resolved in version 2.1.6.
Affected products
- allegroai clearml <= 1.16.5
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory
- 2026-04-30: patched: Fix committed to GitHub repository.