Skip to content
Sign in
7.5 High

CVE-2024-1593 A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters

Description

A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smuggling path traversal sequences using the ';' character in URLs, attackers can manipulate the 'params' portion of the URL to gain unauthorized access to files or directories. This vulnerability allows for arbitrary data smuggling into the 'params' part of the URL, enabling attacks similar to those described in previous reports but utilizing the ';' character for parameter smuggling. Successful exploitation could lead to unauthorized information disclosure or server compromise.

Affected products and versions

Product Affected versions Fixed in
mlflow/mlflow Versions not published
MLflow Versions not published

Other CVEs of mlflow/mlflow

The 55 CVEs of mlflow/mlflow →
CVE-2026-8147 In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper… 8.1 High CVE-2026-4035 A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI… 9.1 Critical CVE-2026-3198 MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API… 6.5 Medium CVE-2026-2651 A vulnerability in MLflow… 9.0 Critical
Track this CVE