What is CVE-2026-8387?

CVE-2026-8387 is a low-severity vulnerability in Allegroai Allegroai/clearml, classified under Relative Path Traversal. CVSS score: 2.4/10. Published 2026-07-01.

How severe is CVE-2026-8387?

Low severity. CVSS v3 base score is 2.4 out of 10.

Path Traversal in Allegroai Allegroai/clearml

CVE-2026-8387

A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting `.zip` archives using the `ZipFile.extractall()` method in `StorageManager._extract_to_cache()`. This issue arises…

CVSS v3 metric

CVSS v3 base score 2.4 (Low). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N.

Affected products

Allegroai Allegroai/clearml — versions unspecified

Weakness classification (CWE)

CWE-23 — Relative Path Traversal

References

security@huntr.dev
security@huntr.dev

Frequently asked questions

What is CVE-2026-8387?: CVE-2026-8387 is a low-severity vulnerability in Allegroai Allegroai/clearml, classified under Relative Path Traversal. CVSS score: 2.4/10. Published 2026-07-01.
How severe is CVE-2026-8387?: Low severity. CVSS v3 base score is 2.4 out of 10.