Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code
Date: 2025-07
Affected: pip/assemblyline-service-client, pip/assemblyline-service-client
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-55013
CWE: CWE-23
CVSS: 4.2 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)

**Path-Traversal -> Arbitrary File Write in Assemblyline Service Client** **IMPORTANT**: This vulnerability is valid if you decide to use the assemblyline-service-client outside of the normal practice to using Assemblyline in a production environment. In practice, this code should always be executed within a containerized environment such as [assemblyline-v4-service](https://github.com/CybercentreCanada/assemblyline-v4-service) which ensures filesystem-level permissions of what the running user is allowed to access. Furthermore, there is fewer chances for a MiTM compromise when deployed properly in a Docker or Kubernetes deployment where the platform will assign the correct network policies to secure connections between containers instead of relying on the user to set this up manually. See https://github.com/CybercentreCanada/assemblyline/issues/382 for further discussion. --- ## 1. Summary The Assemblyline 4 **service client** (`task_handler.py`) accepts a SHA-256 value returned by the service **server** and uses it directly as a local file name. > No validation / sanitisation is performed. A **malicious or compromised server** (or any MITM that can speak to client) can return a path-traversal payload such as `../../../etc/cron.d/evil` and force the client to write the downloaded bytes to an arbitrary location on disk. --- ## 2. Affected Versions | Item | Value | |---|---| | **Component** | `assemblyline-service-client` | | **Repository** | [CybercentreCanad


Mitigations:

Architectural layers (MAESTRO):