Critical severity9.9NVD Advisory· Published Apr 16, 2024· Updated Jun 17, 2026
CVE-2024-2083
CVE-2024-2083
Description
A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The vulnerability arises due to the lack of validation for directory traversal patterns, allowing attackers to access files outside of the restricted directory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
zenmlPyPI | < 0.55.5 | 0.55.5 |
Affected products
3- Range: unspecified
Patches
Vulnerability mechanics
References
5- github.com/zenml-io/zenml/commit/00e934f33a243a554f5f65b80eefd5ea5117367bnvdPatchThird Party AdvisoryWEB
- huntr.com/bounties/f24b2216-6a4b-42a1-becb-9b47e6cf117fnvdExploitIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-6h3f-43vq-53hjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-2083ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2024-247.yamlghsaWEB
News mentions
0No linked articles in our index yet.