CVE-2026-8387: ClearML ZIP Path Traversal & RCE Risk

Technical summary

The vulnerability resides in ClearML's `StorageManager._extract_to_cache()` method, which calls `ZipFile.extractall()` without sanitizing archive member paths. The method lacks path traversal validation, allowing archive entries with relative path sequences (e.g., `../../../etc/cron.d/job`) to escape the intended cache directory. This affects download operations for datasets, artifacts, models, and offline session imports—any flow where user-provided or externally-sourced ZIP files are extracted to the filesystem. CWE-23 (Relative Path Traversal) applies. The vendor resolved this in version 2.1.6 by implementing path validation before extraction.

Business impact

In single-user or air-gapped deployments, impact is minimal due to the CVSS constraints (requires high privilege + user interaction). However, in shared ML infrastructure, federated model repositories, or DevOps pipelines that auto-ingest datasets or models, a compromised or malicious archive could lead to privilege escalation, container escape, or lateral movement. The RCE potential—via cron injection, SSH key overwrite, or web shell placement—means a low-scoring vulnerability in isolation could chain with other issues to achieve system compromise in a broader attack scenario.

Affected systems

ClearML versions up to and including 1.16.5 are vulnerable. The fix is available in version 2.1.6 and later. Any deployment using ClearML for dataset management, model artifact storage, or offline session handling is in scope. Self-hosted instances, Kubernetes clusters running ClearML, and integrations with MLflow or DVC-compatible storage backends that relay files through ClearML may be affected depending on deployment configuration.

Exploitability

Exploitation requires either direct access to ClearML as a high-privilege user (system administrator or dataset curator) or the ability to influence archived files that transit through the system—for example, by poisoning a shared model registry or dataset repository. The CVSS vector (AV:N/AC:L/PR:H/UI:R) reflects that network access is available but a high-privilege account and user click/interaction (downloading a malicious dataset) are prerequisites. In open-source or community-driven ML workflows where users share pre-packaged datasets, this becomes more practical. No known public exploits or in-the-wild campaigns have been reported.

Remediation

Upgrade ClearML to version 2.1.6 or later. For organizations unable to patch immediately, implement network-level controls to restrict ZIP archive sources to trusted repositories, validate archive integrity using cryptographic signatures before import, and apply filesystem permissions to limit write access to sensitive directories (cron, SSH, web root). Consider running ClearML in a containerized environment with read-only root filesystems to constrain damage from path traversal.

Patch guidance

Apply ClearML version 2.1.6 or later. Review your current version with `clearml-init --version` or check `~/.clearml/clearml.conf`. Patch during a maintenance window; no hotfixes or interim versions are mentioned, so a direct upgrade to 2.1.6+ is the path forward. Test the upgrade in a non-production environment first, as major version transitions (1.16.x to 2.1.6) may introduce configuration or API changes. Consult the official ClearML release notes for migration guidance.

Detection guidance

Log and monitor `StorageManager` and ZIP extraction operations within ClearML. Look for extraction attempts with unusual file paths (containing `../` or absolute paths like `/etc/`, `/home/`, `/root/`). In Kubernetes environments, audit PersistentVolume mounts and temp directory writes. Check filesystem audit logs for unexpected file creation in sensitive directories (cron jobs, SSH folders, web directories) coinciding with dataset or artifact downloads. If you have access to ClearML's internal logging, examine cache extraction logs for path traversal patterns.

Why prioritize this

Despite a CVSS score of 2.4 (LOW), prioritize patching if you operate a shared or multi-tenant ClearML instance, accept external datasets, or integrate with community model repositories. The RCE potential and the presence of high-privilege workflows in ML infrastructure elevate practical risk. If your ClearML deployment is fully air-gapped, single-operator, and internal, this can be scheduled for a routine maintenance cycle. Organizations with strict data governance or those in regulated industries (finance, healthcare) handling sensitive model artifacts should treat this as moderate priority.

Risk score, explained

The CVSS 3.0 score of 2.4 reflects: (1) High privilege requirement (PR:H), meaning only admins or power users can trigger downloads; (2) Required user interaction (UI:R), necessitating a click to extract the archive; (3) Limited impact scope (Integrity only, no Confidentiality or Availability loss in the base metric). However, this scoring does not account for the potential for privilege escalation, lateral movement, or RCE via post-extraction abuse. Real-world risk depends on deployment model (shared vs. isolated), data sensitivity, and whether the environment permits cron/SSH/web shell access.

Frequently asked questions