CVE-2025-8917

Medium

Advisory

Published 5 Oct 2025In the index since 5 Sept 2026

clearml is vulnerable to Path Traversal through its `safe_extract` function

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 3 images.

Affected package	Affected versions	Fixed in	Images
clearmlpypi	1.10.1, 1.17.0	2.0.2	3

2 by stars

Chart

Latest

Affected images

Radar Score

clearmlallegroai

1 of the 4 container images this version deploys carry CVE-2025-8917.

Container image	Digest	Package	Fixed in
allegroai/clearml :2.0.0-613	713ae38f7daf	clearml@1.17.0	2.0.2

10,622

2 of the 9 container images this version deploys carry CVE-2025-8917.

Container image	Digest	Package	Fixed in
allegroai/clearml-serving-inference :1.3.0	fca885e8cfc6	clearml@1.10.1	2.0.2
allegroai/clearml-serving-statistics :1.3.0	c58d9da7bdf8	clearml@1.10.1	2.0.2

17,877

3 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
allegroai/clearml :2.0.0-613	713ae38f7daf	clearml@1.17.0	2.0.2	1
allegroai/clearml-serving-inference :1.3.0	fca885e8cfc6	clearml@1.10.1	2.0.2	1
allegroai/clearml-serving-statistics :1.3.0	c58d9da7bdf8	clearml@1.10.1	2.0.2	1