MLflowGHSA-5r3q-93q3-f978

MLflow Path Traversal Vulnerability

High7.5CVE-2023-6909 · Published Dec 20, 2023 · updated Feb 15, 2025

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

GitHub advisory

Affected versions

Package	Affected	Fixed in
mlflow PyPI	< 2.9.2	2.9.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-29
Also known as: BIT-mlflow-2023-6909, CVE-2023-6909, PYSEC-2023-252

More MLflow advisories

Date	Advisory	Severity	Fixed in
Dec 202023	MLflow Server-Side Request Forgery (SSRF) Critical9.8Dec 20, 2023 CVE-2023-69742.9.2	Critical9.8	2.9.2
Dec 202023	MLFlow Path Traversal Vulnerability Critical9.8Dec 20, 2023 CVE-2023-69752.9.2	Critical9.8	2.9.2
Dec 202023	MLflow Local File Disclosure Vulnerability High7.5Dec 20, 2023 CVE-2023-69772.9.2	High7.5	2.9.2
Dec 202023	MLflow Path Traversal Vulnerability High8.8Dec 20, 2023 CVE-2023-69762.9.2	High8.8	2.9.2
Dec 192023	mlflow Command Injection vulnerability High8.8Dec 19, 2023 CVE-2023-69402.9.2	High8.8	2.9.2
Dec 152023	Path traversal in MLflow Critical10.0Dec 15, 2023 CVE-2023-68312.9.2	Critical10.0	2.9.2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.