Advisoriesby IbisMLflowGHSA-5cvj-7rg6-jggj
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
Fix: upgrade to 2.22.4 or later (2 fixed versions below)
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | >= 3.0.0rc0, < 3.0.0 | 3.0.0 |
| < 2.22.4 | 2.22.4 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- BIT-mlflow-2025-11201, CVE-2025-11201, PYSEC-2026-1640
- nvd.nist.gov/vuln/detail/CVE-2025-11201
- github.com/B-Step62/mlflow/commit/2e02bc7bb70df243e6eb792689d9b8eba0013161
- github.com/mlflow/mlflow/commit/5f98ff98659dddb188591ecf6b10a4e276a0dba7
- github.com/mlflow/mlflow/commit/e7dc0574fa3459e0003cfeb68d4e4a625491f03d
- github.com/mlflow/mlflow
- www.zerodayinitiative.com/advisories/ZDI-25-931
More MLflow advisories
All MLflow
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution VulnerabilityCVE-2026-2033fixed in 3.8.0rc0MLflow Use of Default Password Authentication Bypass VulnerabilityCVE-2026-2635fixed in 3.8.0rc0mlflow Creates of Temporary File in Directory with Insecure PermissionsCVE-2025-10279fixed in 3.4.0rc0MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validationCVE-2025-14279fixed in 3.5.0MLflow Weak Password Requirements Authentication Bypass VulnerabilityCVE-2025-11200fixed in 2.22.0rc0MLFlow SSRF via gateway_proxy_handlerCVE-2025-52967fixed in 2.22.2 +1