AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MLflowGHSA-wv8q-4f85-2p8p

MLflow Path Traversal Vulnerability

MLflow

CVE-2023-6976 · Published Dec 20, 2023 · updated Jul 7, 2026

High8.8
Fix: upgrade to 2.9.2 or later
GitHub advisory

This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

Affected versions

PackageAffectedFixed in
mlflow
PyPI
< 2.9.22.9.2
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-434
Also known as
BIT-mlflow-2023-6976, CVE-2023-6976, PYSEC-2026-1662

More MLflow advisories

All MLflow
Critical 9.8Dec 20, 2023MLflow Server-Side Request Forgery (SSRF)CVE-2023-6974fixed in 2.9.2High 7.5Dec 20, 2023MLflow Path Traversal VulnerabilityCVE-2023-6909fixed in 2.9.2Critical 9.8Dec 20, 2023MLFlow Path Traversal VulnerabilityCVE-2023-6975fixed in 2.9.2High 7.5Dec 20, 2023MLflow Local File Disclosure VulnerabilityCVE-2023-6977fixed in 2.9.2High 8.8Dec 19, 2023mlflow Command Injection vulnerabilityCVE-2023-6940fixed in 2.9.2Critical 10.0Dec 15, 2023Path traversal in MLflowCVE-2023-6831fixed in 2.9.2