Path Traversal: '\..\filename' in mlflow/mlflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.
- Update to 2.3.0
- Update to 2.3.1
Published Updated
PatchFirst · Latest vulnerabilities
mlflow vulnerabilities · Page 5
Vulnerabilities published for mlflow in the last 30 days: 5. Listed in the KEV catalogue: 0.
Vulnerabilities: 87
CVE-2023-30172
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
- Update to 2.0.0rc0
- Update to 2.0.1
Published UpdatedRemote file access vulnerability in `mlflow server` and `mlflow ui` CLIs
### Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the ``mlflow server`` or ``mlflow ui`` commands using an MLflow version older than **MLflow 2.3.1** may be vulnerable to a remote file access exploit if they are not limiting who can query their server (for example, by using a cloud VPC, an IP allowlist for inbound requests, or authentication / authorization middleware). This issue only affects users and integrations that run the ``mlflow server`` and ``mlflow ui`` commands. Integrations that do not make use of ``mlflow server`` or ``mlflow ui`` are unaffected; for example, the Databricks Mana
- Update to 2.3.1
Published UpdatedRelative Path Traversal in mlflow/mlflow
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
- Update to 2.3.1
Published UpdatedPath Traversal: '\..\filename' in mlflow/mlflow
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
- Update to 2.2.1
Published UpdatedAbsolute Path Traversal in mlflow/mlflow
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.
- Update to 2.2.1
- Update to 2.2.2
Published UpdatedInsecure Temporary File in mlflow/mlflow
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
- Update to 1.23.1
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.