MLflow Path Traversal Vulnerability

GHSA-wv8q-4f85-2p8p · BIT-mlflow-2023-6976 · CVE-2023-6976 · PYSEC-2026-1662

Published Dec 20, 2023 · Modified Jul 7, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-6976
WEB https://github.com/mlflow/mlflow/commit/5044878da0c1851ccfdd5c0a867157ed9a502fbc
PACKAGE https://github.com/mlflow/mlflow
WEB https://huntr.com/bounties/2408a52b-f05b-4cac-9765-4f74bac3f20f

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

MLflow Path Traversal Vulnerability

Description

References

More PyPI vulnerabilities

Start Securing