A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact_location` parameter when creating an experiment

A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters

A path traversal vulnerability exists in the `_create_model_version()` function within `server/handlers.py` of the mlflow/mlflow repository, due to improper validation of the…

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server

This vulnerability enables malicious users to read sensitive files on the server

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API

MLflow allowed arbitrary files to be PUT onto the server

A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path…

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1

Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1

Server-Side Request Forgery (SSRF) in mlflow/mlflow

Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1

Privilege Escalation in mlflow/mlflow

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf

Improper Access Control in mlflow/mlflow

Authorization Bypass in SearchModelVersions in mlflow/mlflow

A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password

Stored XSS via unsafe YAML parsing in MLflow

A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding

A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any…

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a…

Authorization Bypass in MLflow AJAX Endpoint

MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2