CVE-2025-8917: 
ClearML Server vulnerability analysis and mitigation

CVE-2025-8917 is a path traversal vulnerability in the safe_extract function of the allegroai/clearml Python package (versions before 2.0.2) that allows arbitrary file writes outside the intended extraction directory via improper handling of symbolic and hard links in tar archives. The vulnerability was published on October 5, 2025, and assigned GHSA-579p-qf78-fqm2. It carries a CVSS v3.0 base score of 5.8 (Moderate), requiring local access, high privileges, and user interaction (Github Advisory, ENISA EUVD).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The safe_extract function in clearml/storage/util.py was designed to prevent path traversal (originally addressing CVE-2007-4559) by checking whether extracted members resolve within the target directory, but it failed to validate symbolic links (issym()) and hard links (islnk()). An attacker could craft a malicious tar archive containing symlinks or hard links whose targets resolve outside the intended extraction directory, bypassing the existing is_within_directory check and enabling arbitrary file writes. The fix, applied in commit 64fb2bc, adds explicit checks for both link types by resolving the absolute path of member.linkname and verifying it remains within the base extraction directory (Github Commit, Github Advisory).

Successful exploitation allows an attacker to write arbitrary files to locations outside the intended extraction directory on the host system. If critical system or application files are overwritten (e.g., configuration files, scripts, or executables), this could escalate to remote code execution. The vulnerability affects both confidentiality and integrity — sensitive files could be read via symlink redirection and existing files could be corrupted or replaced — though availability is not directly impacted (Github Advisory, ENISA EUVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.03% per GitHub Advisory), placing it in the 9th percentile for exploitation likelihood within 30 days. Exploitation requires local access, high privileges, and user interaction (e.g., a privileged user extracting a maliciously crafted archive), which significantly limits the practical attack surface. No threat actor attribution or CISA KEV catalog listing has been identified (Github Advisory, ENISA EUVD).

1. Craft a malicious tar archive: Create a tar file containing a symbolic link or hard link whose linkname resolves to a path outside the intended extraction directory (e.g., a symlink named safe_file.txt pointing to ../../etc/cron.d/malicious).
2. Deliver the archive: Provide the malicious tar archive to a privileged ClearML user or process that will invoke the safe_extract function — for example, by uploading it as a ClearML artifact or dataset.
3. Trigger extraction: Induce the privileged user or automated pipeline to extract the archive using the vulnerable safe_extract function in clearml/storage/util.py.
4. Achieve arbitrary file write: The unvalidated symlink/hard link causes the extraction to write attacker-controlled content to the symlink target path outside the extraction directory.
5. Escalate to code execution: If the overwritten file is a script, configuration, or executable loaded by a privileged process (e.g., a cron job or service), the attacker achieves remote or local code execution (Github Advisory, Github Commit).

• File System: Unexpected files created outside the ClearML artifact/dataset extraction directory; symbolic links in extracted directories pointing to sensitive system paths (e.g., /etc/, /var/, home directories); modification timestamps on system files (cron jobs, SSH authorized_keys, service configs) coinciding with ClearML extraction events.
• Logs: ClearML application logs showing extraction of tar archives followed by unexpected file write errors or permission changes in system directories; OS audit logs (auditd) recording file creation events outside expected ClearML working directories by the ClearML process.
• Process: ClearML worker or server process spawning unexpected child processes (shells, interpreters) shortly after artifact extraction operations.

Upgrade clearml (pip) to version 2.0.2 or later, which contains the fix that explicitly validates symbolic and hard link targets during tar extraction (Github Advisory, Github Commit). As interim mitigations, restrict file write permissions for the ClearML service account, avoid extracting untrusted tar archives with privileged accounts, and implement OS-level controls (e.g., AppArmor, SELinux) to confine ClearML process file access. Regularly audit ClearML artifact sources to ensure only trusted archives are processed.

The vulnerability was reported via the Huntr bug bounty platform and disclosed on October 5, 2025. The GitHub Advisory Database rated it as Moderate severity, and the fix was merged promptly by the ClearML maintainers. No significant broader media coverage or notable researcher commentary beyond the advisory and patch has been identified (Github Advisory).