PT-2026-54931 · Allegro Ai · Clearml

Published 2026-07-01 · Updated 2026-07-02 · CVE-2026-8387

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions allegroai/clearml versions prior to 2.1.6

Description Relative path traversal occurs during the extraction of .zip archives via the ZipFile.extractall() method within the StorageManager. extract to cache() function. This is caused by a lack of path traversal validation, which allows an attacker to write arbitrary files to the filesystem. Potential attack vectors include dataset, artifact, and model downloads, as well as offline session imports. This can lead to remote code execution through techniques such as SSH key overwrite, cron job injection, or web shell deployment.

Recommendations Update to version 2.1.6.

Exploit

Fix

RCE

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-8387

Affected Products

Clearml

References · 6

• 🔥 https://huntr.com/bounties/0f69bb0b-728e-411c-8676-8f2dfaf238db · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8387 · Security Note
• https://github.com/allegroai/clearml/commit/4fd611c564256e4f294a6db133705120f203f476 · Note
• https://twitter.com/CVEnew/status/2072324839419871391 · Twitter Post
• https://t.me/cveNotify/185389 · Telegram Post
• https://twitter.com/infoflowcloud/status/2072325767275438307 · Twitter Post