CVE-2025-10952

MediumCVSS 5.3

Published: 25/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

44th percentile - higher than 44% of all known CVEs

Summary

A security flaw was discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. The function stream_handler in ml_logger/server.py is affected; manipulating the key argument leads to information disclosure. The attack can be initiated remotely and the exploit has been released.

Risk Assessment

A remote attacker may gain access to sensitive information stored in logs, potentially compromising data integrity and user privacy.

Recommendation

Update ml-logger to the latest available version or restrict access to the server and monitor logs for suspicious activity.

Other vulnerabilities in ml-logger

CVE-2025-10950Medium
Vulnerability in the ml-logger project (up to commit acf255bade5be6ad88d90735c8367b28cbe3a743) affects the log_handler function in ml_logger/server.py, Ping Handler component. Manipulation of the data argument causes deserialization, which can be exploited remotely.

Original NVD description (English source)

A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function stream_handler of the file ml_logger/server.py of the component File Handler. Performing manipulation of the argument key results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS