High severity7.8NVD Advisory· Published Oct 5, 2025· Updated Jun 17, 2026
CVE-2025-8406
CVE-2025-8406
Description
ZenML version 0.83.1 is affected by a path traversal vulnerability in the PathMaterializer class. The load function uses is_path_within_directory to validate files during data.tar.gz extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
zenmlPyPI | >= 0.81.0, < 0.84.2 | 0.84.2 |
Affected products
3- Range: unspecified
Patches
Vulnerability mechanics
References
4- github.com/zenml-io/zenml/commit/5d22a48d7bf6c7f10b748577c2be79cc7969d398nvdPatchWEB
- huntr.com/bounties/a0880d64-9928-45bf-9663-2cd81582d9e7nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-q92x-2x5g-h365ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-8406ghsaADVISORY
News mentions
0No linked articles in our index yet.