Path Traversal Vulnerability in mlflow/mlflow

Local File Read via Path Traversal in mlflow/mlflow

Path Traversal via Parameter Smuggling in mlflow/mlflow

Path Traversal Vulnerability in mlflow/mlflow

Path Traversal: '\..\filename'

Path Traversal: '\..\filename' in mlflow/mlflow

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API

MLflow Arbitrary File Upload

A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path…

Relative Path Traversal in mlflow/mlflow

Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1

Server-Side Request Forgery (SSRF) in mlflow/mlflow

Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow

CSRF in mlflow/mlflow

Privilege Escalation in mlflow/mlflow

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf

Improper Access Control in mlflow/mlflow

Authorization Bypass in SearchModelVersions in mlflow/mlflow

Reflected XSS via Content-Type Header in mlflow/mlflow

gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation

Weak Password Requirements in mlflow/mlflow

Stored XSS via unsafe YAML parsing in MLflow

Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow

Improper Access Control in mlflow/mlflow

Uncontrolled Resource Consumption in mlflow/mlflow

Authorization Bypass in MLflow AJAX Endpoint

MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash

Absolute Path Traversal in mlflow/mlflow