MLflowGHSA-v945-r3rc-6fjm

Path traversal in MLflow

High8.8CVE-2023-6753 · Published Dec 13, 2023 · updated Apr 9, 2025

Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.

GitHub advisory

Affected versions

Package	Affected	Fixed in
mlflow PyPI	< 2.9.2	2.9.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-22
Also known as: BIT-mlflow-2023-6753, CVE-2023-6753, PYSEC-2023-309

More MLflow advisories

Date	Advisory	Severity	Fixed in
Dec 202023	MLflow Path Traversal Vulnerability High8.8Dec 20, 2023 CVE-2023-69762.9.2	High8.8	2.9.2
Dec 202023	MLflow Local File Disclosure Vulnerability High7.5Dec 20, 2023 CVE-2023-69772.9.2	High7.5	2.9.2
Dec 192023	mlflow Command Injection vulnerability High8.8Dec 19, 2023 CVE-2023-69402.9.2	High8.8	2.9.2
Dec 152023	Path traversal in MLflow Critical10.0Dec 15, 2023 CVE-2023-68312.9.2	Critical10.0	2.9.2
Dec 122023	Jinja2 template injection in mlflow High8.8Dec 12, 2023 CVE-2023-67092.9.2	High8.8	2.9.2
Dec 72023	Cross-site Scripting (XSS) in MLflow Medium6.5Dec 7, 2023 CVE-2023-65682.9.0	Medium6.5	2.9.0

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.