Skip to content
OpenAdvisories
High · 8.8 CVE-2023-6976 BIT-mlflow-2023-6976EUVD-2023-3319GHSA-wv8q-4f85-2p8pPYSEC-2026-1662

Unrestricted Upload of File with Dangerous Type

Published Dec 20, 2023 · Updated Aug 2, 2024 · Assigned by @huntr_ai

Vendor: MLflow Product: mlflow/mlflow Package: mlflow Ecosystem: PyPI

Description

This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

Affected products

VendorProductAffectedFixed
mlflow mlflow/mlflow unspecified – < 2.9.2 2.9.2

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI mlflow < 2.9.2 2.9.2 GHSA-wv8q-4f85-2p8p

References