Cyber Resilience

CVE-2023-5245

HighPublic PoC

Published: 15 November 2023

Published
15 November 2023
Modified
25 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0044 63.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-5245 is a high-severity Path Traversal (CWE-22) vulnerability in Combust Mleap. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 36.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as Deep Learning Frameworks.

EU & UK References

Vulnerability details

FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the saved_model format and an exported tensorflow model, the apply()…

more

function invokes the vulnerable implementation of FileUtil.extract(). Arbitrary file creation can directly lead to code execution

CWE(s)
CWE-22

AI Security AnalysisAI

AI Category
Deep Learning Frameworks
Risk Domain
N/A
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: tensorflow

Related Threats

Affected Assets

combust
mleap
0.18.0, 0.23.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References