CVE-2026-127202

MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious modelid parameter to the log outputs API. Attackers can exploit the unvalidated modelid...