AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

MLflowGHSA-f798-qm4r-23r5

MLflow allowed arbitrary files to be PUT onto the server

MLflow

CVE-2023-6015 · Published Nov 16, 2023 · updated Jun 29, 2026

Critical10.0
Fix: upgrade to 2.8.1 or later
GitHub advisory

MLflow allowed arbitrary files to be PUT onto the server.

Affected versions

PackageAffectedFixed in
mlflow
PyPI
< 2.8.12.8.1
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-22
Also known as
BIT-mlflow-2023-6015, CVE-2023-6015, PYSEC-2026-420

More MLflow advisories

All MLflow
High 8.8Dec 13, 2023Path traversal in MLflowCVE-2023-6753fixed in 2.9.2High 8.8Dec 12, 2023Jinja2 template injection in mlflowCVE-2023-6709fixed in 2.9.2Medium 6.5Dec 7, 2023Cross-site Scripting (XSS) in MLflowCVE-2023-6568fixed in 2.9.0High 7.5Dec 5, 2023Information exposure in MLflowCVE-2023-43472fixed in 2.9.0Critical 9.1Nov 16, 2023MLflow authentication requirement bypass can allow a user to arbitrarily create an accountCVE-2023-6014fixed in 2.8.0Critical 10.0Nov 16, 2023Remote Code Execution due to Full Controled File Write in mlflowCVE-2023-6018fixed in 2.9.2