Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · MLflow

CVE-2024-1594: mlflow vulnerable to Path Traversal

highCVSS 3.0 7.5GHSA-m49c-5c52-6696

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the artifactlocation parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component # in the artifact location URI to read arbitrary files on the server in the context of the server's process.

Published Apr 16, 2024

Affected packages

mlflow

Ecosystem
PyPI
Affected
<= 2.9.2
Fixed in
No patched version yet
Check
pip show mlflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the artifact_location parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component # in the artifact location URI to read arbitrary files on the server in the context of the server's process. This issue is similar to CVE-2023-6909 but utilizes a different component of the URI to achieve the same effect.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More MLflow vulnerabilities

All MLflow entries