Path Traversal

MLflow is vulnerable to a path traversal attack. The vulnerability is due to improper handling of the artifact_location parameter when creating an experiment, allowing attackers to exploit the fragment component # of the URI to read arbitrary files on the server in the context of the server’s process.