Path Traversal Leading to Remote Code Execution in allegroai/clearml

A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.

N/A

对路径名的限制不恰当(路径遍历)

clearml 安全漏洞

clearml是allegroai个人开发者的一个大模型流水线工具。 clearml v2.0.1版本存在安全漏洞，该漏洞源于safe_extract函数处理符号链接和硬链接不当，可能导致任意文件写入和远程代码执行。

N/A

N/A