https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:17:50.112256+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-8406 CVE-2025-8406 — Path Traversal in zenml-io/zenml 2026-10-03T01:17:50.113822+00:00

Affected: zenml-io/zenml

ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten.

 https://cve.radiocsirt.org/vuln/ghsa-q92x-2x5g-h365 GHSA-q92x-2x5g-h365 — ZenML is vulnerable to Path Traversal through its `PathMaterializer` class 2026-10-03T01:17:50.113871+00:00

Affected: PyPI: zenml

ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links. This vulnerability can lead to arbitrary file writes, potentially resulting in arbitrary command execution if critical files are overwritten.