Vulnerability · Published Sep 25, 2025 · Assigned by VulDB

CVE-2025-10951geyang ml-logger server.py log_handler path traversal

High 7.3

In plain English

A high-severity path traversal in ml-logger from geyang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.7%top 45.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

A vulnerability was identified in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this vulnerability is the function log_handler of the file ml_logger/server.py. Such manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	ml-logger	no fix listed	GHSA-8x9j-2p8r-7xc6
PyPI	ml-logger	no fix listed	PYSEC-2026-1634

Affected products (as reported)

Vendor	Product	Versions
geyang	ml-logger	acf255bade5be6ad88d90735c8367b28cbe3a743

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-325821 | geyang ml-logger server.py log_handler path traversal vdb-entry, technical-description
VDB-325821 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #652462 | geyang ml-logger latest Unrestricted Upload third-party-advisory
https://github.com/geyang/ml-logger/issues/73 exploit, issue-tracking