1212 matches found
GHSA-WXJ7-3FX5-PP9M MLFlow SSRF via gateway_proxy_handler
gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...
CVE-2025-52967
gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...
PYSEC-2025-52
gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...
PYSEC-2025-52
gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...
CVE-2025-52967
gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...
CVE-2025-52967
MLflow prior to 3.1.0 is affected by a gateway_proxy_handler issue that lacks gateway_path validation, enabling potential SSRF via gateway routes. The CVE-2025-52967 description specifies a missing validation in gateway_proxy_handler, with CVSSv3.1 vector indicating network attack, low complexity...
PT-2025-26607
Name of the Vulnerable Software and Affected Versions: MLflow versions prior to 3.1.0 Description: The issue is related to the gateway proxy handler in MLflow, which lacks gateway path validation. This could potentially lead to exploitation. Recommendations: For versions prior to 3.1.0, update to...
CVE-2025-52967
gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...
CVE-2025-52967
gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...
MLflow 代码问题漏洞
MLflow is an open source platform from MLflow that simplifies machine learning development, including tracking experiments, packaging code into repeatable runs, and sharing and deploying models. A code issue vulnerability exists in MLflow versions prior to 3.1.0 that stems from a missing...
CVE-2024-3099
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service DoS as an authenticated user might not be able to use the intended model, as it will open a different model each time...
CVE-2023-1177
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...
CVE-2023-6909
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...
CVE-2023-30172
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter...
CVE-2023-2356
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...
CVE-2023-1176
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...
CVE-2023-6014
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment...
CVE-2023-6018
An attacker can overwrite any file on the server hosting MLflow without any authentication...
CVE-2023-6568
A reflected Cross-Site Scripting XSS vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the us...