Critical Path Traversal Vulnerability in Assemblyline Service Client
Summary
CVE-2025-55013: Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code. Affects assemblyline-service-client across 2 version ranges.
< 4.6.0.stable11
>= 4.6.1.dev0, < 4.6.1.dev138
Fixed in 4.6.0.stable11 or 4.6.1.dev138, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Assemblyline Service Client is a Python package designed to interact with the Assemblyline service, facilitating tasks such as file downloads and processing. It is widely used in environments where automated file handling is essential. However, the client has a critical vulnerability that allows for arbitrary file writes due to improper handling of server responses, making it susceptible to exploitation by malicious actors.
Vulnerability Detail
The vulnerability arises from the Assemblyline Service Client's task_handler.py, where it accepts a SHA-256 value from the service server without any validation or sanitization. This oversight allows an attacker to exploit path traversal techniques, enabling them to specify arbitrary file paths. For instance, a malicious server could return a payload like '../..//etc/cron.d/evil', causing the client to write files to sensitive locations on the disk. The ramifications include potential data integrity issues, availability disruptions, and even code execution if the written files are executable.
How To Fix
Latest published version: 4.7.5.dev156 as of 23 Oct 2026
pip install --upgrade "assemblyline-service-client==4.7.5.dev156"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.6.0.stable114.6.0.stable11pip install --upgrade "assemblyline-service-client==4.6.0.stable11" -
>= 4.6.1.dev0, < 4.6.1.dev1384.6.1.dev138pip install --upgrade "assemblyline-service-client==4.6.1.dev138"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the service server is trusted and does not return unvalidated SHA-256 values. Implementing additional checks on the server side to restrict file paths can also mitigate the risk until the package is updated.
Conclusion
The Assemblyline Service Client has a critical path traversal vulnerability that allows for arbitrary file writes. Users are strongly advised to update to the latest patched versions to mitigate risks. Implementing proper validation in the code is essential to prevent exploitation.
See every vulnerability recorded for assemblyline-service-client →
FAQ
The vulnerability has a CVSS score of 10.0, indicating it is critical and poses a significant risk to affected systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The impacts include unauthorized file writes, data corruption, service disruptions, and potential code execution on the affected system.
Yes, users should upgrade to version 4.6.0.stable11 or 4.6.1.dev138 of the Assemblyline Service Client to mitigate the vulnerability.
If an immediate update is not possible, ensure that the service server is secure and implement additional validation checks on file paths.
