AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MLflowGHSA-x422-6qhv-p29g

Relative path traversal in mlflow

MLflow

CVE-2023-2356 · Published Apr 28, 2023 · updated Feb 16, 2025

High10.0
Fix: upgrade to 2.3.1 or later
GitHub advisory

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.

Affected versions

PackageAffectedFixed in
mlflow
PyPI
< 2.3.12.3.1
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Severity from
GitHub (reviewed advisory)
Weakness
CWE-23
Also known as
BIT-mlflow-2023-2356, CVE-2023-2356, PYSEC-2023-68

More MLflow advisories

All MLflow
Critical 10.0Jul 19, 2023MLflow Path Traversal vulnerabilityCVE-2023-3765fixed in 2.5.0Critical 9.8May 17, 2023mlflow Path Traversal vulnerabilityCVE-2023-2780fixed in 2.3.0High 7.5May 11, 2023mflow vulnerable to directory traversalCVE-2023-30172fixed in 2.0.0rc0CriticalMay 1, 2023Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIsGHSA-83fm-w79m-64r5fixed in 2.3.1Medium 3.3Mar 24, 2023Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIsCVE-2023-1176fixed in 2.2.1Critical 9.8Mar 24, 2023mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIsCVE-2023-1177fixed in 2.2.1