CVE-2025-27770 in UpTrain
Summary
by MITRE • 08/17/2026
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the `/create_project` endpoint is vulnerable to remote code execution via the `checks` and `metadata` parameters. Any user that has access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container as suggested by the documentation. As of time of publication, no known patch is available.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified within UpTrain versions 0.7.1 and prior represents a critical security flaw located specifically at the /create_project endpoint. This open-source platform, designed for evaluating and improving generative AI applications, suffers from an insecure deserialization or code injection mechanism when processing user-supplied input through the checks and metadata parameters. The core technical failure lies in how these specific fields are parsed and executed by the backend system. Instead of treating the data as simple string values or structured configuration objects that undergo strict validation, the application appears to interpret certain payloads within these parameters as executable code or instructions for dynamic evaluation. This architectural oversight allows an attacker who has valid authentication credentials to inject malicious logic directly into the processing pipeline of the UpTrain server.
The operational impact of this vulnerability is severe due to its classification as a Remote Code Execution (RCE) flaw. Because any authenticated user can exploit this weakness, the threat model extends beyond external attackers to include compromised internal accounts or users with lower privilege levels who should not have administrative capabilities. The execution context is particularly dangerous because UpTrain typically operates within Docker containers in production environments. Consequently, successful exploitation grants an attacker code execution privileges inside that container. This effectively compromises the isolation boundaries of the application layer and can lead to a complete takeover of the host system if container escape vulnerabilities are also present or if the container runs with excessive permissions such as root access mounted volumes.
From a classification perspective, this vulnerability aligns closely with CWE-94, which describes Improper Control of Generation of Code (Code Injection), specifically when user input is directly executed without adequate sanitization. It also maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as the attacker utilizes the application's own execution environment to run arbitrary commands. The lack of a patch at the time of publication exacerbates the risk profile for organizations relying on this version, necessitating immediate defensive measures rather than waiting for an official vendor fix.
To mitigate this vulnerability in the absence of a software update, administrators must implement strict input validation and sanitization strategies for all endpoints accepting complex data structures like checks and metadata. Implementing allowlists for expected parameter formats can prevent malicious payloads from being processed as executable code. Additionally, deploying Web Application Firewalls with rules capable of detecting injection patterns may provide an additional layer of defense. It is also critical to enforce the principle of least privilege by ensuring that Docker containers run with minimal permissions, disabling unnecessary features such as dynamic evaluation engines if they are not strictly required for core functionality. Regular auditing of user access rights and monitoring for anomalous process executions within the container environment can further aid in early detection and containment of exploitation attempts until a patched version is released.