CVE-2024-2083 is a critical path traversal flaw in the ZenML server API, scored CVSS 9.9. A crafted logs URI in a request to the steps endpoint can read arbitrary files from outside the intended directory. A fix landed as an artifact store isolation change, but check the advisory for the first release that carries it.
What's affected
The record names the zenml-io/zenml repository, specifically the /api/v1/steps endpoint, and does not give a version range. NVD classifies the weakness as CWE-29, a path traversal pattern, and scores it 9.9 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The score reflects a network attack of low complexity by an account with low privileges, with a changed scope and high impact on confidentiality, integrity and availability.
The description says an attacker can manipulate the logs URI path in a request and fetch arbitrary file content. The cause is a lack of validation for directory traversal patterns, which lets a request reach files outside the restricted directory. It was published on 2024-04-16.
For the fix, the record points to a commit in the ZenML repository, titled "Improve Artifact Store isolation (#2490)". It reroutes artifact and log access through the artifact store and adds path sanitizing in the artifact store base class. We read the commit page but it does not state which release first shipped it, and we could not retrieve the bounty report listed in the record. We therefore cannot confirm a fixed version number, and you should check the project's release notes and the huntr report before choosing a target version.
How to check if you're exposed
Find where ZenML runs. The server is the part that exposes the API:
pip show zenml
zenml version
Run those in the environment of the ZenML server, not just on developer laptops. Check container images and deployment manifests for a pinned ZenML version too:
grep -rn "zenml" requirements*.txt pyproject.toml Dockerfile* 2>/dev/null
Because the record gives no version range, a version number alone cannot tell you that you are safe. Compare your version against the project's release notes for the artifact store isolation change from pull request 2490. If your release predates it, treat the server as affected.
Next, check exposure. The CVSS vector requires a low privileged account, so who can authenticate to your ZenML server matters. List the users and service accounts with access, and check whether the server is reachable from the internet or only from an internal network.
The free in-browser dependency scan at gold.safeguard.sh/scan can show which projects of yours pull in ZenML, which is a useful first step if it is installed as a dependency of a pipeline repository.
What to do now
- Identify every ZenML server and every environment that runs the ZenML package.
- Confirm the first release that includes the artifact store isolation change from pull request 2490, using the project release notes, and upgrade to that release or later.
- Limit network access to the ZenML server to the networks that need it, and keep it off the public internet where you can.
- Review accounts and API keys with access to the server and remove any you do not recognize.
- Treat the host the server runs on as potentially exposed if it was reachable by untrusted users. Rotate secrets and credentials that live on files the service account can read.
- Check server and web logs for unusual requests to the steps endpoint, especially ones with long or odd looking logs paths.
Why it matters
Path traversal bugs happen when a server builds a file path from user supplied input and does not confirm the result stays inside the directory it meant to serve. Here the input is a URI for logs. A path that looks like a log location can be bent to point somewhere else on the file system, and the server reads it back.
What makes this one score 9.9 is the combination of a network reachable endpoint, a low bar of privilege and a changed scope. A machine learning platform server often sits next to cloud credentials, configuration files and model artifacts, so arbitrary file read is rarely harmless. The record does not describe the specific files that are reachable, so we will not guess.
CVE-2024-2083 is not on the CISA Known Exploited Vulnerabilities list, and none of the sources we read report exploitation in the wild.
Try it yourself
This demo shows how reachability analysis narrows a long list of findings down to the ones your code can actually hit.
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-2083 fixed?
A fix is in the repository as a commit that improves artifact store isolation. We could not confirm from the sources which release first contains it, so check the ZenML release notes.
Do I need an account to exploit it?
The CVSS vector lists low privileges required, so an authenticated account is expected, but no user interaction.
Sources
- ZenML commit 00e934f, Improve Artifact Store isolation
- Gold entry for CVE-2024-2083
- The huntr bounty report is referenced by the record but could not be retrieved.
Last reviewed: 19 October 2026.
