Zenml-io vulnerabilities
We track 4 vulnerabilities in Zenml-io products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 5, 2025.
Latest Zenml-io vulnerabilities
- 7.8 High severity
zenml-io/zenml: Improper Limitation of a Pathname to a Restricted Directory
ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links
- 7.5 High severity
zenml-io/zenml: Loop with Unreachable Exit Condition
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. Thi
- 8.8 High severity
A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session…
A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access
- 9.9 Critical severity
zenml-io/zenml: Path Traversal: '..filename'
A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing