HIGH🇵🇱 Wersja polska

CVE-2024-28424

CVSS 8.8v3.1pub. 2024-03-14upd. 2025-05-05

zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted file.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Zenml

    APP
    Zenml
    0.55.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2024-2083CRITICAL9.9PL ✓ten sam produkt

Path Traversal w ZenML – odczyt dowolnych plików przez endpoint /api/v1/steps

CVE-2025-8406HIGH7.8ten sam produkt

ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load`...

CVE-2024-9340HIGH7.5ten sam produkt

A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to c...

CVE-2024-4680HIGH8.8ten sam produkt

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session ...

CVE-2024-25723HIGH8.8ten sam produkt

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation...