CVE-2025-27770highCWE-74

CVE-2025-27770: falha de alta gravidade em uptrain-ai uptrain

UpTrain vulnerable to Remote code execution at `/create_project`

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar uptrain

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.4epss 0.8%
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/create_project` endpoint is vulnerable to remote code execution via the `checks` and `metadata` parameters. Any user that has access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container as suggested by the documentation. As of time of publication, no known patch is available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
uptrain-ai · uptrain
CVEs relacionadas — uptrain-ai uptrain

No mesmo produto, das mais perigosas para as menos.

CVE-2025-27772HIGHUptrain vulnerable to remote code execution via `/new_run` endpointEPSS 0.8%CVE-2025-27771HIGHUptrain vulnerable to remote code execution via `/add_prompts` endpointEPSS 0.8%CVE-2025-27621HIGHUpTrain has a Constant Default API KeyEPSS 0.5%