description: In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.
problem types: Path Traversal
affected:
{
product: ClickHouse
vendor: n/a
versions:
status: affected, version: All versions prior to version 18.12.13.
}