MLflowGHSA-5cvj-7rg6-jggj
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
High8.1CVE-2025-11201 · Published Oct 29, 2025 · updated Jul 7, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | >= 3.0.0rc0, < 3.0.0 | 3.0.0 |
| < 2.22.4 | 2.22.4 |
Details and references
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- BIT-mlflow-2025-11201, CVE-2025-11201, PYSEC-2026-1640
- nvd.nist.gov/vuln/detail/CVE-2025-11201
- github.com/B-Step62/mlflow/commit/2e02bc7bb70df243e6eb792689d9b8eba0013161
- github.com/mlflow/mlflow/commit/5f98ff98659dddb188591ecf6b10a4e276a0dba7
- github.com/mlflow/mlflow/commit/e7dc0574fa3459e0003cfeb68d4e4a625491f03d
- github.com/mlflow/mlflow
- www.zerodayinitiative.com/advisories/ZDI-25-931
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Oct 292025 | MLflow Weak Password Requirements Authentication Bypass Vulnerability CVE-2025-11200High8.1fixed in 2.22.0rc0 | High8.1 | 2.22.0rc0 |
| Jan 12 | MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation CVE-2025-14279High8.1fixed in 3.5.0 | High8.1 | 3.5.0 |
| Feb 2 | mlflow Creates of Temporary File in Directory with Insecure Permissions CVE-2025-10279High7.0fixed in 3.4.0rc0 | High7.0 | 3.4.0rc0 |
| Feb 21 | MLflow Use of Default Password Authentication Bypass Vulnerability CVE-2026-2635Critical9.8fixed in 3.8.0rc0 | Critical9.8 | 3.8.0rc0 |
| Feb 21 | MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability CVE-2026-2033High8.1fixed in 3.8.0rc0 | High8.1 | 3.8.0rc0 |
| Jun 232025 | MLFlow SSRF via gateway_proxy_handler CVE-2025-52967Medium5.8fixed in 2.22.2, 3.1.0 | Medium5.8 | 2.22.2, 3.1.0 |