CVE-2026-127202 MLflow < 3.18.0 Path Traversal via model_id in log_outputs API

MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious modelid parameter to the log outputs API. Attackers can exploit the unvalidated modelid...