mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

GHSA-XG73-94FP-G449 mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

CVE-2023-1176

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

CVE-2023-1177

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

PYSEC-2023-29

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

PYSEC-2023-28

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

Path traversal

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

PYSEC-2023-28

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

PYSEC-2023-29

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

Path traversal

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

CVE-2023-1177 Path Traversal: '\..\filename' in mlflow/mlflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

CVE-2023-1177 Path Traversal: '\..\filename' in mlflow/mlflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

CVE-2023-1176: Absolute Path Traversal

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

CVE-2023-1177: Path Traversal: '\..\filename'

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

Mlflow 安全漏洞

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.2.2 that stems from the presence of an absolute path traversal vulnerability...

CVE-2023-1176 Absolute Path Traversal in mlflow/mlflow

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

Mlflow 路径遍历漏洞

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.2.1 that stems from the presence of a path traversal vulnerability...

CVE-2023-1177 Path Traversal: '\..\filename' in mlflow/mlflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

CVE-2023-1176

The CVE affects the open source MLflow project mlflow/mlflow prior to version 2.2.2 (ABSOLUTE PATH TRAVERSAL). Documented in multiple sources, the vulnerability allows an attacker to traverse the filesystem to access arbitrary files on the host via the mlflow server/ui workflow (attack vector: LO...

CVE-2023-1177

CVE-2023-1177 is a path traversal / local-file-inclusion vulnerability in mlflow/mlflow prior to 2.2.1. Affects the MLflow server endpoints handling model-versions and artifacts (e.g., GET /model-versions/get-artifact) where a crafted path can disclose files outside the intended directory. Concre...