MLflowGHSA-fhff-qmm8-h2fp
Arbitrary file write via tar traversal in mlflow
High8.1CVE-2025-15031 · Published Mar 19, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 3.9.0rc0 | 3.9.0rc0 |
Details and references
A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arbitrary file overwrites and potential remote code execution.
- CVSS 3.0
- CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- BIT-mlflow-2025-15031, CVE-2025-15031, PYSEC-2026-2656
- nvd.nist.gov/vuln/detail/CVE-2025-15031
- github.com/mlflow/mlflow/commit/3bf6d81ac4d38654c8ff012dbd0c3e9f17e7e346
- github.com/mlflow/mlflow
- github.com/mlflow/mlflow/blob/fe4d9be330426904283401f1d2ed914238b6fc37/mlflow/pyfunc/dbconnect_artifact_cache.py#L140
- huntr.com/bounties/09856f77-f968-446f-a930-657d126efe4e
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 16 | MLflow has a command injection in mlflow/sagemaker/__init__.py CVE-2025-14287High7.5fixed in 3.8.0rc0 | High7.5 | 3.8.0rc0 |
| Mar 27 | MLFlow allows Tracing + Assessments Access CVE-2025-15381High8.1no fix yet | High8.1 | No fix yet |
| Mar 30 | MLFlow path traversal vulnerability CVE-2025-15036Critical9.6fixed in 3.9.0rc0 | Critical9.6 | 3.9.0rc0 |
| Mar 30 | MLflow Command Injection vulnerability CVE-2025-15379Critical10.0fixed in 3.8.1 | Critical10.0 | 3.8.1 |
| Mar 31 | Mlflow: Command Injection when serving models with enable_mlserver=True CVE-2026-0596Critical9.6fixed in 3.9.0 | Critical9.6 | 3.9.0 |
| Apr 3 | mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization CVE-2026-0545Critical9.1no fix yet | Critical9.1 | No fix yet |