MLflowGHSA-hh8p-p8mp-gqhm
MLFlow Path Traversal Vulnerability
Critical9.8CVE-2023-6975 · Published Dec 20, 2023 · updated Jun 29, 2026
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 2.9.2 | 2.9.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-29
- Also known as
- BIT-mlflow-2023-6975, CVE-2023-6975, PYSEC-2026-422
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Dec 202023 | MLflow Server-Side Request Forgery (SSRF) Critical9.8Dec 20, 2023 | Critical9.8 | 2.9.2 |
| Dec 202023 | MLflow Path Traversal VulnerabilityHigh7.5Dec 20, 2023 | High7.5 | 2.9.2 |
| Dec 202023 | MLflow Local File Disclosure VulnerabilityHigh7.5Dec 20, 2023 | High7.5 | 2.9.2 |
| Dec 202023 | MLflow Path Traversal VulnerabilityHigh8.8Dec 20, 2023 | High8.8 | 2.9.2 |
| Dec 192023 | mlflow Command Injection vulnerabilityHigh8.8Dec 19, 2023 | High8.8 | 2.9.2 |
| Dec 152023 | Path traversal in MLflowCritical10.0Dec 15, 2023 | Critical10.0 | 2.9.2 |