Skip to content
OpenAdvisories

Vendor

MLflow

90 known vulnerabilities.

Products

mlflow/mlflow 55 MLflow 35
All Critical High Medium Low Exploited only Public exploit

47 results · Clear filters · Feed

  • High 8.1
    CVE-2024-1560

    Path Traversal Vulnerability in mlflow/mlflow

    A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path validation by exploiting the double decoding process in the `_delete_artifact_mlflow_artifacts` handler a…

    MLflow mlflow/mlflow mlflow PyPI
  • High 8.8
    CVE-2023-6976

    Unrestricted Upload of File with Dangerous Type

    This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

    MLflow mlflow/mlflow mlflow PyPI
  • High 8.6
    CVE-2023-6974

    Server-Side Request Forgery (SSRF)

    A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.

    MLflow mlflow/mlflow mlflow PyPI
  • High 7.5
    CVE-2023-6909 Scanner template EPSS 90%

    Path Traversal: '\..\filename' in mlflow/mlflow

    Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

    MLflow mlflow/mlflow mlflow PyPI
  • High 8.1
    CVE-2023-6831 Scanner template

    Path Traversal: '\..\filename' in mlflow/mlflow

    Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.

    MLflow mlflow/mlflow mlflow PyPI
  • High 8.8
    CVE-2023-4033

    OS Command Injection in mlflow/mlflow

    OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.

    MLflow mlflow/mlflow mlflow PyPI
  • High 8.2
    CVE-2022-0736

    Insecure Temporary File in mlflow/mlflow

    Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.

    MLflow mlflow/mlflow mlflow PyPI