MLflowGHSA-554w-xh4j-8w64

Path traversal in MLflow

Critical10.0CVE-2023-6831 · Published Dec 15, 2023 · updated Feb 16, 2024

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

GitHub advisory

Affected versions

Package	Affected	Fixed in
mlflow PyPI	< 2.9.2	2.9.2

Details and references

CVSS 3.0: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-22, CWE-29
Also known as: BIT-mlflow-2023-6831, CVE-2023-6831, PYSEC-2023-253

More MLflow advisories

Date	Advisory	Severity	Fixed in
Dec 202023	MLflow Path Traversal Vulnerability High8.8Dec 20, 2023 CVE-2023-69762.9.2	High8.8	2.9.2
Dec 202023	MLflow Local File Disclosure Vulnerability High7.5Dec 20, 2023 CVE-2023-69772.9.2	High7.5	2.9.2
Dec 202023	MLFlow Path Traversal Vulnerability Critical9.8Dec 20, 2023 CVE-2023-69752.9.2	Critical9.8	2.9.2
Dec 192023	mlflow Command Injection vulnerability High8.8Dec 19, 2023 CVE-2023-69402.9.2	High8.8	2.9.2
Dec 132023	Path traversal in MLflow High8.8Dec 13, 2023 CVE-2023-67532.9.2	High8.8	2.9.2
Dec 122023	Jinja2 template injection in mlflow High8.8Dec 12, 2023 CVE-2023-67092.9.2	High8.8	2.9.2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.