CVE-2023-5245

FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the saved_model format and an exported tensorflow model, the apply() function invokes the vulnerable implementation of FileUtil.extract(). Arbitrary file creation can directly lead to code execution

• CWE-22

• https://github.com/combust/mleap/pull/866#issuecomment-1738032225Issue Tracking, Patch
• https://research.jfrog.com/vulnerabilities/mleap-path-traversal-rce-xray-532656/Exploit, Third Party Advisory
• https://github.com/combust/mleap/pull/866#issuecomment-1738032225Issue Tracking, Patch
• https://research.jfrog.com/vulnerabilities/mleap-path-traversal-rce-xray-532656/Exploit, Third Party Advisory

Published

Nov 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-52444In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52445In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52446In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52447In the Linux kernel, the following vulnerability has been re…6.7
• CVE-2023-52448In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52449In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52450In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52451In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52452In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2023-52453In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52454In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2023-52455In the Linux kernel, the following vulnerability has been re…7.8