Description
A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `safe_extract` function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files are overwritten.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| allegroai | allegroai/clearml | unspecified – < 2.0.2 | 2.0.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | clearml | < 2.0.2 | 2.0.2 | GHSA-579p-qf78-fqm2 |