GHSA-XG73-94FP-G449 mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs

🗓️ 24 Mar 2023 22:01:09Reported by GoogleType

osv

osv🔗 osv.dev👁 23 Views

MLflow remote file access vulnerability patched in version 2.2.

Reporter	Title	Published	Views	Family All 24
Huntr	LFI/RFI in MLflow	3 Mar 202317:15	–	huntr
Huntr	Local File Read Bypass in mlflow/mlflow	27 Mar 202311:20	–	huntr
GithubExploit	Exploit for Path Traversal in Lfprojects Mlflow	12 Apr 202510:33	–	githubexploit
BDU FSTEC	The vulnerability of the ML lifecycle management platform, related to an incorrect restriction on the path name for the restricted access catalog, allows a perpetrator to gain unauthorized access to protected information, execute arbitrary code, or obtain full control over the system.	30 Mar 202300:00	–	bdu_fstec
Circl	CVE-2023-1177	24 Mar 202317:50	–	circl
CNNVD	Mlflow 路径遍历漏洞	24 Mar 202300:00	–	cnnvd
CVE	CVE-2023-1177	24 Mar 202300:00	–	cve
Cvelist	CVE-2023-1177 Path Traversal: '\..\filename' in mlflow/mlflow	24 Mar 202300:00	–	cvelist
Github Security Blog	Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs	1 May 202313:43	–	github
Github Security Blog	mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs	24 Mar 202322:01	–	github

Source	Link
github	www.github.com/mlflow/mlflow/security/advisories/GHSA-xg73-94fp-g449
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-1177
github	www.github.com/mlflow/mlflow/pull/7891/commits/7162a50c654792c21f3e4a160eb1a0e6a34f6e6e
github	www.github.com/mlflow/mlflow/commit/7162a50c654792c21f3e4a160eb1a0e6a34f6e6e
github	www.github.com/mlflow/mlflow
github	www.github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2023-29.yaml
huntr	www.huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28

22 Feb 2026 22:56Current

9.9High risk

Vulners AI Score9.9

CVSS 49.3

CVSS 3.19.8

EPSS0.69468

mlflow vulnerability remote file access patch version 2.2.1 security workaround nist