MLflowGHSA-x422-6qhv-p29g

Relative path traversal in mlflow

High10.0CVE-2023-2356 · Published Apr 28, 2023 · updated Feb 16, 2025

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.

GitHub advisory

Affected versions

Package	Affected	Fixed in
mlflow PyPI	< 2.3.1	2.3.1

Details and references

CVSS 3.0: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Severity from: GitHub (reviewed advisory)
Weakness: CWE-23
Also known as: BIT-mlflow-2023-2356, CVE-2023-2356, PYSEC-2023-68

More MLflow advisories

Date	Advisory	Severity	Fixed in
Jul 192023	MLflow Path Traversal vulnerability Critical10.0Jul 19, 2023 CVE-2023-37652.5.0	Critical10.0	2.5.0
May 172023	mlflow Path Traversal vulnerability Critical9.8May 17, 2023 CVE-2023-27802.3.0	Critical9.8	2.3.0
May 112023	mflow vulnerable to directory traversal High7.5May 11, 2023 CVE-2023-301722.0.0rc0	High7.5	2.0.0rc0
May 12023	Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs CriticalMay 1, 2023 GHSA-83fm-w79m-64r52.3.1	Critical	2.3.1
Mar 242023	Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs Medium3.3Mar 24, 2023 CVE-2023-11762.2.1	Medium3.3	2.2.1
Mar 242023	mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs Critical9.8Mar 24, 2023 CVE-2023-11772.2.1	Critical9.8	2.2.1

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.