CVE-2025-27770highCWE-74

CVE-2025-27770: fallo de gravedad alta en uptrain-ai uptrain

UpTrain vulnerable to Remote code execution at `/create_project`

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear uptrain

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.4epss 0.8%
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/create_project` endpoint is vulnerable to remote code execution via the `checks` and `metadata` parameters. Any user that has access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container as suggested by the documentation. As of time of publication, no known patch is available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Productos afectados
uptrain-ai · uptrain
CVEs relacionadas — uptrain-ai uptrain

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-27772HIGHUptrain vulnerable to remote code execution via `/new_run` endpointEPSS 0.8%CVE-2025-27771HIGHUptrain vulnerable to remote code execution via `/add_prompts` endpointEPSS 0.8%CVE-2025-27621HIGHUpTrain has a Constant Default API KeyEPSS 0.5%