PT-2025-39399 · Unknown · Geyang Ml-Logger

0X1F · Published 2025-09-25 · Updated 2025-09-25 · CVE-2025-10951

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions geyang ml-logger versions prior to acf255bade5be6ad88d90735c8367b28cbe3a743

Description A path traversal issue exists in the log handler function within the ml logger/server.py file. Manipulation of the File argument can lead to unauthorized file access. This issue is potentially exploitable remotely and an exploit is publicly available.

Recommendations Update to a version later than acf255bade5be6ad88d90735c8367b28cbe3a743. As a temporary workaround, restrict access to the ml logger/server.py file. Avoid using the File parameter in the log handler function until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-10951

GHSA-8X9J-2P8R-7XC6

Affected Products

Geyang Ml-Logger

References · 11

• 🔥 https://github.com/geyang/ml-logger/issues/73 · Exploit
• https://osv.dev/vulnerability/GHSA-8x9j-2p8r-7xc6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10951 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10951 · Vendor Advisory
• https://github.com/geyang/ml-logger · Note
• https://vuldb.com/?submit.652462 · Note
• https://t.me/cveNotify/136409 · Telegram Post
• https://vuldb.com/?ctiid.325821 · Note
• https://twitter.com/CVEnew/status/1971232401280971183 · Twitter Post
• https://t.me/CVEtracker/33336 · Telegram Post
• https://vuldb.com/?id.325821 · Note