A flaw in allegroai/clearml allows an attacker to craft a ZIP archive that, when processed by ZipFile.extractall() in StorageManager._extract_to_cache(), writes files outside the intended directory. Because the code does not validate extraction paths, an attacker can place arbitrary files onto the server, potentially injecting a cron job, overwriting an SSH key, or deploying a web shell so that remote code execution is possible.

All ClearML versions up to and including 1.16.5 are affected. The vulnerability is triggered whenever a ZIP archive is extracted during dataset downloads, artifact downloads, model downloads, or offline session imports. The issue is resolved in version 2.1.6.

The EPSS score is reported as <1%, indicating a very low probability that this vulnerability will be exploited in the near term. The CVSS score of 2.4 reflects low overall severity, yet the flaw enables critical exploitation if a malicious ZIP file is processed. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread attacks are currently known. However, once a supplyable malicious archive is used, the lack of path validation allows an attacker to write files to arbitrary host locations, compromising confidentiality, integrity, or availability of ClearML and the underlying system.