Description
In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ClickHouse | All versions prior to version 18.12.13. | — |