UpHeron
All vulnerabilities

Servers and applications

CVE-2023-1177

Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

Severity
Critical 9.8
Published
24 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.2.1
Also known as
GHSA-xg73-94fp-g449
Sources
NVD, Project advisories (GitHub)

Description

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.

Affected software

SoftwareAffected versions
MLflowServers and applications · cpe:a:lfprojects:mlflow
  • Every version before 2.2.1
MLflowServers and applications · github:mlflow/mlflow
  • Every version before 2.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-1177
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-1177
  • GitHub Advisory Database https://github.com/advisories/GHSA-xg73-94fp-g449
  • github.com https://github.com/mlflow/mlflow/security/advisories/GHSA-xg73-94fp-g449