EUVD-2025-208848
GHSA-fhff-qmm8-h2fp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v3.0 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates adjacent network attack vector with low complexity requiring no privileges or user interaction, resulting in high confidentiality and integrity impact. While the adjacent network requirement (AV:A) slightly reduces exposure compared to network-based attacks, the combination of no authentication required and low complexity makes this highly exploitable in shared infrastructure scenarios. The vulnerability is particularly dangerous in multi-tenant MLflow deployments, cloud-based ML platforms, or any environment where untrusted model artifacts are processed. The presence of a detailed exploit report on Huntr (https://huntr.com/bounties/09856f77-f968-446f-a930-657d126efe4e) suggests proof-of-concept code exists, significantly increasing real-world risk. The tags explicitly mention RCE potential, elevating this from a simple file write to a critical security issue. Organizations running MLflow in production, especially those accepting external model artifacts or operating in shared environments, should treat this as high priority despite the adjacent network limitation. |
| Exploit ScenarioDerived | An attacker with access to an adjacent network in a multi-tenant MLflow environment crafts a malicious model artifact packaged as a tar.gz file containing entries with '../../../' path traversal sequences. When a user or automated system loads this model through MLflow's pyfunc interface, the unsafe extractall operation writes files outside the intended directory, potentially overwriting Python library files, cron jobs, or SSH authorized_keys files, leading to remote code execution when those files are subsequently executed by the system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
MLflow, a popular open-source machine learning lifecycle platform, contains a path traversal vulnerability in its pyfunc extraction process that allows arbitrary file writes. The vulnerability stems from unsafe use of tarfile.extractall without proper path validation, enabling attackers to craft malicious tar.gz files with directory traversal sequences or absolute paths to write files outside the intended extraction directory. This poses critical risk in multi-tenant environments and can lead to remote code execution, with a CVSS score of 8.1 and confirmed exploit details available via Huntr.
RemediationAI
Organizations should immediately review the Huntr vulnerability disclosure at https://huntr.com/bounties/09856f77-f968-446f-a930-657d126efe4e for official patch information and upgrade to a patched version of MLflow as soon as available. Until patching is possible, implement strict controls on artifact sources by only accepting model artifacts from trusted, verified sources and implementing network segmentation to limit MLflow's access to adjacent network resources. Consider implementing additional validation layers that inspect tar.gz archives before extraction, rejecting any files containing path traversal sequences or absolute paths. In multi-tenant environments, run MLflow instances in isolated containers with restricted filesystem permissions and use read-only mounts where possible to limit the impact of arbitrary file writes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects MLflow (cpe:2.3:a:mlflow:mlflow/mlflow:*:*:*:*:*:*:*:*), specifically in the pyfunc extraction mechanism that processes tar.gz artifact files. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. Python's tarfile.extractall method, when used without validation, is vulnerable to Zip Slip-style attacks where archive entries containing '../' sequences or absolute paths can write files to arbitrary locations on the filesystem. In MLflow's context, this occurs during model artifact extraction, where malicious model packages could overwrite critical system files, configuration files, or inject malicious code into application directories.
Know when Mlflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of tarfile.extractall without path validation enables crafted tar.gz files containing .. or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arbitrary file overwrites and potential remote code execution.
Executive ViewAI
MLflow deployments are vulnerable to arbitrary file writes through malicious model files, creating a critical remote code execution risk especially in multi-tenant environments where isolated customer data could be compromised. Organizations using MLflow for production machine learning workflows should prioritize immediate mitigation as no patch is currently available and active exploits are documented.
Disable pyfunc model format support if operationally feasible; restrict MLflow model upload functionality to authenticated internal users only; implement file integrity monitoring on MLflow extraction directories; segment MLflow infrastructure from production systems using network policies; deploy WAF rules to block suspicious tar.gz uploads; run MLflow processes with minimal file system permissions and in containerized environments with read-only root filesystems where possible; monitor MLflow logs for extraction errors and unauthorized file writes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
Unauthenticated remote code execution in MLflow 3.12.0rc0 through 3.16.x lets any network caller reach the tracking serv
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Exploit-DB