zenml-io/zenml vulnerabilities

4 known vulnerabilities in zenml-io/zenml from Zenml-io. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  zenml-io/zenml: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-8406Oct 5, 2025Zenml-io

  ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_directory` to validate files during `data.tar.gz` extraction, which fails to effectively detect symbolic and hard links

• 7.5 High severity

  zenml-io/zenml: Loop with Unreachable Exit Condition

  CVE-2024-9340Mar 20, 2025Zenml-io

  A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. Thi

• 8.8 High severity

  A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session…

  CVE-2024-4680Jun 8, 2024Zenml-io

  A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access

• 9.9 Critical severity

  zenml-io/zenml: Path Traversal: '..filename'

  CVE-2024-2083Apr 16, 2024Zenml-ioEPSS 37.2%

  A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing