Description
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mlflow | < 2.0.0rc0 | 2.0.0rc0 | GHSA-wc6j-5g83-xfm6 |
| PyPI | mlflow | < 2.0.1 | 2.0.1 | PYSEC-2023-70 |