Veracode Vulnerability DatabaseVERACODE:39985Path Traversal
0.039 Low
EPSS
Percentile
92.0%
mlflow is vulnerable to Path Traversal. The vulnerability exists due to improper access control in handlers.py which allows an attacker to traverse outside the restricted directory and download arbitrary files on the server. Note that mlflow is only affected if it runs with either mlflow server or mlflow ui.
References
github.com/advisories/GHSA-xg73-94fp-g449
github.com/mlflow/mlflow/commit/7162a50c654792c21f3e4a160eb1a0e6a34f6e6e
github.com/mlflow/mlflow/commit/d622ee7b49152a2b77507c43b401ab7fdeeba27f
github.com/mlflow/mlflow/issues/7884
github.com/mlflow/mlflow/pull/7891/commits/7162a50c654792c21f3e4a160eb1a0e6a34f6e6e
github.com/mlflow/mlflow/pull/7908
huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28
huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28/
Related
