Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · MLflow

CVE-2023-2780: mlflow Path Traversal vulnerability

criticalCVSS 4.0 9.3 · 3.0 9.8GHSA-wjq3-7jxx-whj9

mlflow prior to 2.3.0 is vulnerable to path traversal due to a bypass of the fix for CVE-2023-1177.

Published May 17, 2023 · Updated Sep 24, 2024

Affected packages

mlflow

Ecosystem
PyPI
Affected
< 2.3.0
Fixed in
2.3.0
Check
pip show mlflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

mlflow prior to 2.3.0 is vulnerable to path traversal due to a bypass of the fix for CVE-2023-1177.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More MLflow vulnerabilities

All MLflow entries