CVE-2026-8387: ClearML Path Traversal Vulnerability

CVE-2026-8387 Overview

CVE-2026-8387 is a relative path traversal vulnerability [CWE-23] in allegroai/clearml versions up to and including 1.16.5. The flaw resides in StorageManager._extract_to_cache(), which invokes ZipFile.extractall() without validating archive member paths. An attacker who supplies a malicious .zip archive can write arbitrary files outside the intended extraction directory. Attack vectors include dataset downloads, artifact downloads, model downloads, and offline session imports. Successful exploitation can lead to remote code execution via cron job injection, SSH key overwrite, or web shell deployment. The issue is resolved in version 2.1.6.

Critical Impact
Arbitrary file write through crafted ZIP archives, enabling remote code execution on ClearML worker and client hosts.

Affected Products

allegroai/clearml versions up to and including 1.16.5
ClearML SDK dataset, artifact, and model download workflows
ClearML offline session import functionality

Discovery Timeline

2026-07-01 - CVE-2026-8387 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-8387

Vulnerability Analysis

The vulnerability originates in the ClearML storage subsystem, which unpacks remote archives during dataset, artifact, and model retrieval. The extraction routine passes archive contents directly to Python's ZipFile.extractall() without verifying that each entry resolves to a path inside the target directory. Python's standard library does not enforce this check, so an archive containing entries like ../../etc/cron.d/payload writes to arbitrary filesystem locations.

Because ClearML agents commonly execute as privileged users on training infrastructure, an attacker who controls a dataset or model artifact can drop files into locations such as ~/.ssh/authorized_keys, /etc/cron.d/, or web server document roots. This transforms an archive-write primitive into remote code execution on shared MLOps infrastructure.

Root Cause

The root cause is missing path traversal validation in clearml/storage/util.py and related archive handling code. The extractor trusted archive member names without normalizing paths or confirming containment within the extraction target.

Attack Vector

An authenticated user with the ability to upload or reference a malicious archive on a ClearML server can trigger extraction on any client or worker that consumes the resource. Attack surfaces include Dataset.get(), artifact retrieval, model downloads, and Task.import_offline_session().

python

# Security patch in clearml/storage/archive.py
import os
import tarfile
from typing import Union, Any
from pathlib import Path
from zipfile import ZipFile

from .filepaths import is_within_directory


def extract_zip_archive(
    archive_path: str,
    target: str = ".",
) -> None:
    """
    Extracts a .zip archive file to a target location.
    """
    with ZipFile(file=archive_path, mode='r') as zip_file:
        base_directory = os.path.abspath(target)
        for file_path in zip_file.namelist():
            flag_path_traversal_vulnerability(
                extraction_folder=base_directory,
                extraction_file_path=file_path,
            )
            # zip_file.extractall does not create symlinks
        zip_file.extractall(path=target)

Source: GitHub commit 4fd611c. The patch introduces is_within_directory checks via flag_path_traversal_vulnerability before invoking extractall().

Detection Methods for CVE-2026-8387

Indicators of Compromise

Unexpected file writes to ~/.ssh/authorized_keys, /etc/cron.d/, /etc/cron.hourly/, or web-accessible directories on ClearML agent or client hosts
ZIP archives containing entries with .. sequences or absolute paths in ClearML dataset or artifact storage
New or modified files created by the ClearML agent process outside its cache directory (typically ~/.clearml/cache/)
Outbound connections from ClearML workers to unfamiliar hosts following dataset or model downloads

Detection Strategies

Inspect archive contents server-side before publication by iterating ZipFile.namelist() and rejecting entries whose resolved paths escape the archive root
Audit ClearML server logs for dataset, artifact, and model uploads correlated with subsequent unusual file activity on consuming clients
Deploy file integrity monitoring on sensitive paths on all hosts running the ClearML SDK or agent

Monitoring Recommendations

Alert on process executions spawned by the ClearML agent that write to cron, SSH, or web server directories
Track version strings reported by ClearML clients and workers to identify hosts still running vulnerable releases at or below 1.16.5
Monitor for Task.import_offline_session() invocations sourced from untrusted archive locations

How to Mitigate CVE-2026-8387

Immediate Actions Required

Upgrade all ClearML SDK and agent installations to version 2.1.6 or later
Revoke and rotate SSH keys, API tokens, and service credentials on any host that consumed untrusted archives while running a vulnerable version
Restrict dataset, artifact, and model publishing privileges on the ClearML server to trusted users pending upgrade

Patch Information

The fix is included in allegroai/clearml version 2.1.6. It adds is_within_directory validation in clearml/storage/archive.py for each ZIP entry before extraction. Review the GitHub commit 4fd611c and the Huntr bounty report for full technical details.

Workarounds

Run ClearML agents under dedicated, unprivileged service accounts with no write access to cron, SSH, or web server directories
Extract dataset and artifact archives inside disposable sandboxes or containers with read-only host mounts until the upgrade is complete
Pre-scan uploaded ZIP archives to reject any member whose normalized path escapes the intended extraction root

bash

# Upgrade ClearML to the patched release
pip install --upgrade "clearml>=2.1.6"

# Verify installed version
python -c "import clearml; print(clearml.__version__)"