What is CVE-2025-8917?

CVE-2025-8917 is a medium-severity vulnerability in Allegroai Allegroai/clearml, classified under Path Traversal. CVSS score: 5.8/10. Published 2025-10-05.

How severe is CVE-2025-8917?

Medium severity. CVSS v3 base score is 5.8 out of 10.

Is CVE-2025-8917 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Path Traversal in Allegroai Allegroai/clearml

CVE-2025-8917

A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.003 (20.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N.

Affected products

Allegroai Allegroai/clearml — versions unspecified

Weakness classification (CWE)

CWE-22 — Path Traversal

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

Frequently asked questions

What is CVE-2025-8917?: CVE-2025-8917 is a medium-severity vulnerability in Allegroai Allegroai/clearml, classified under Path Traversal. CVSS score: 5.8/10. Published 2025-10-05.
How severe is CVE-2025-8917?: Medium severity. CVSS v3 base score is 5.8 out of 10.
Is CVE-2025-8917 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.