~ / search / GHSA-6h3f-43vq-53hj

GHSA-6h3f-43vq-53hj

Directory traversal in zenml

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-2083

Packages

EcosystemPackageAffectedFixed in
PyPI zenml < 0.55.5 0.55.5

Details

As written in the advisory (Markdown source, shown as plain text).

A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The vulnerability arises due to the lack of validation for directory traversal patterns, allowing attackers to access files outside of the restricted directory.

References

External links from the advisory. They lead to third-party sites.