CVE-2025-8406

ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten.

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-25)

CWE

CWE-22

Published

2025-10-05

Modified

2026-10-19

Record from

the NVD, synced 2026-10-19

Affected

• zenml:zenml

Packages (OSV)

References

• https://github.com/zenml-io/zenml/commit/5d22a48d7bf6c7f10b748577c2be79cc7969d398
• https://huntr.com/bounties/a0880d64-9928-45bf-9663-2cd81582d9e7
• https://huntr.com/bounties/a0880d64-9928-45bf-9663-2cd81582d9e7

Check your stackJSON