EUVD-2025-208848
GHSA-fhff-qmm8-h2fp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of tarfile.extractall without path validation enables crafted tar.gz files containing .. or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arbitrary file overwrites and potential remote code execution.
AnalysisAI
MLflow, a popular open-source machine learning lifecycle platform, contains a path traversal vulnerability in its pyfunc extraction process that allows arbitrary file writes. The vulnerability stems from unsafe use of tarfile.extractall without proper path validation, enabling attackers to craft malicious tar.gz files with directory traversal sequences or absolute paths to write files outside the intended extraction directory. This poses critical risk in multi-tenant environments and can lead to remote code execution, with a CVSS score of 8.1 and confirmed exploit details available via Huntr.
Technical ContextAI
The vulnerability affects MLflow (cpe:2.3:a:mlflow:mlflow/mlflow:*:*:*:*:*:*:*:*), specifically in the pyfunc extraction mechanism that processes tar.gz artifact files. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. Python's tarfile.extractall method, when used without validation, is vulnerable to Zip Slip-style attacks where archive entries containing '../' sequences or absolute paths can write files to arbitrary locations on the filesystem. In MLflow's context, this occurs during model artifact extraction, where malicious model packages could overwrite critical system files, configuration files, or inject malicious code into application directories.
RemediationAI
Organizations should immediately review the Huntr vulnerability disclosure at https://huntr.com/bounties/09856f77-f968-446f-a930-657d126efe4e for official patch information and upgrade to a patched version of MLflow as soon as available. Until patching is possible, implement strict controls on artifact sources by only accepting model artifacts from trusted, verified sources and implementing network segmentation to limit MLflow's access to adjacent network resources. Consider implementing additional validation layers that inspect tar.gz archives before extraction, rejecting any files containing path traversal sequences or absolute paths. In multi-tenant environments, run MLflow instances in isolated containers with restricted filesystem permissions and use read-only mounts where possible to limit the impact of arbitrary file writes.
More in Mlflow Mlflow
View allMLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
Authentication bypass in MLflow 3.9.0 and earlier allows unauthenticated remote attackers to access protected Job API an
Remote unauthenticated attackers can read arbitrary files from MLflow server filesystems in versions 3.9.0 and earlier.
Critical command injection in MLflow 3.8.0 enables remote code execution during model deployment when attackers supply m
Path traversal in MLflow's tar.gz extraction (mlflow/mlflow versions <3.7.0) allows remote attackers to overwrite arbitr
Cross-origin request forgery in MLflow 3.9.0's Assistant feature allows remote attackers to bypass loopback-only protect
Cross-user artifact overwrite in MLflow versions prior to 3.10.0 allows authenticated users with --serve-artifacts mode
Command injection vulnerability in MLflow versions before v3.7.0 that allows attackers to execute arbitrary commands by
Broken access control in MLflow prior to 3.14.0 lets any authenticated user read, modify, or delete traces belonging to
Command injection in MLflow's MLServer integration allows unauthenticated adjacent network attackers to execute arbitrar
Local privilege escalation to arbitrary code execution in MLflow versions prior to 3.11.0 stems from insecure temporary
Server-side environment variable disclosure in MLflow versions prior to 3.11.0 allows attackers to exfiltrate sensitive
Same weakness CWE-22 – Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today