AIKIDO-2025-10536
zenml is vulnerable to Path Traversal
82
High Risk
This Affects:
zenmlTL;DR
Affected versions of the package are vulnerable to path traversal attacks due to insufficient validation in the PathMaterializer:load function. While the implementation checks whether the member name resides within the intended directory before extraction, it fails to properly validate the target paths of symbolic and hard links. This oversight allows attackers to craft archive entries that escape the destination directory, potentially leading to arbitrary file overwrite or unauthorized file access.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
zenml is vulnerable to Path Traversal in versions 0.0.1 - 0.84.1.
How to fix this
Upgrade the zenml library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant