MLflowGHSA-5p3h-7fwh-92rc
Remote Code Execution due to Full Controled File Write in mlflow
Critical10.0CVE-2023-6018 · Published Nov 16, 2023 · updated Jun 29, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 2.9.2 | 2.9.2 |
Details and references
The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution (like overwriting `/home/<user>/.bashrc`). A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-78
- Also known as
- BIT-mlflow-2023-6018, CVE-2023-6018, PYSEC-2026-417
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 162023 | MLflow allowed arbitrary files to be PUT onto the server CVE-2023-6015Critical10.0fixed in 2.8.1 | Critical10.0 | 2.8.1 |
| Nov 162023 | MLflow authentication requirement bypass can allow a user to arbitrarily create an account CVE-2023-6014Critical9.1fixed in 2.8.0 | Critical9.1 | 2.8.0 |
| Dec 52023 | Information exposure in MLflow CVE-2023-43472High7.5fixed in 2.9.0 | High7.5 | 2.9.0 |
| Dec 72023 | Cross-site Scripting (XSS) in MLflow CVE-2023-6568Medium6.5fixed in 2.9.0 | Medium6.5 | 2.9.0 |
| Dec 122023 | Jinja2 template injection in mlflow CVE-2023-6709High8.8fixed in 2.9.2 | High8.8 | 2.9.2 |
| Dec 132023 | Path traversal in MLflow CVE-2023-6753High8.8fixed in 2.9.2 | High8.8 | 2.9.2 |