A flaw in allegroai/clearml allows an attacker to craft a ZIP archive that, when processed by the ZipFile.extractall() method in StorageManager._extract_to_cache(), writes files outside the intended cache directory. The lack of path traversal validation (CWE-23) can result in arbitrary files being created on the host filesystem, potentially enabling remote code execution via cron job injection, SSH key overwrite, or web shell installation. Although the CVSS score of 2.4 reflects low severity, the vulnerability permits critical exploitation once a malicious archive is processed.

Versions of ClearML up to and including 1.16.5 are affected. The issue surfaces whenever a ZIP archive is extracted during dataset downloads, artifact downloads, model downloads, or offline session imports. Version 2.1.6 and later contain a fix that validates extraction paths.

The EPSS score is reported as <1% and the CVSS score of 2.4 indicates low severity, yet the vulnerability permits critical exploitation once a malicious archive is supplied. The vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation under current conditions. However, the affectation vector relies on the attacker being able to supply a malicious ZIP file to any of the import endpoints. Once supplied, the lack of path validation allows the attacker to write files to arbitrary locations on the host, potentially compromising confidentiality, integrity, or availability of the ClearML service and its underlying system.